| From: | Noah Misch <noah(at)leadboat(dot)com> |
|---|---|
| To: | pgsql-committers(at)lists(dot)postgresql(dot)org |
| Subject: | pgsql: Check for USAGE privilege on the composite type in ALTER TABLE O |
| Date: | 2026-08-10 13:41:23 |
| Message-ID: | E1wtQFn-00000000y5V-0SbF@gemulon.postgresql.org |
| Views: | Whole Thread | Raw Message | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-committers |
Check for USAGE privilege on the composite type in ALTER TABLE OF.
This omission allowed roles without USAGE on a type to create
tables that depend on it, which could prevent the owner from
changing the type later.
Reported-by: Nathan Bossart <nathandbossart(at)gmail(dot)com>
Author: Nathan Bossart <nathandbossart(at)gmail(dot)com>
Reviewed-by: Robert Haas <robertmhaas(at)gmail(dot)com>
Security: CVE-2026-6470
Backpatch-through: 14
Branch
------
REL_19_STABLE
Details
-------
https://git.postgresql.org/pg/commitdiff/bb1bc525dc01985efeda58a3e613e381146df6a7
Author: Nathan Bossart <nathan(at)postgresql(dot)org>
Modified Files
--------------
src/backend/commands/tablecmds.c | 5 +++++
src/test/regress/expected/privileges.out | 6 ++++++
src/test/regress/sql/privileges.sql | 5 +++++
3 files changed, 16 insertions(+)
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Noah Misch | 2026-08-10 13:41:24 | pgsql: pg_dump: avoid assuming how long pg_proc.protrftypes can be. |
| Previous Message | Noah Misch | 2026-08-10 13:41:22 | pgsql: Use palloc_array() in pltcl and plperl to avoid overflow |