| From: | Noah Misch <noah(at)leadboat(dot)com> |
|---|---|
| To: | pgsql-committers(at)lists(dot)postgresql(dot)org |
| Subject: | pgsql: Check for USAGE privilege on the composite type in ALTER TABLE O |
| Date: | 2026-08-10 13:41:25 |
| Message-ID: | E1wtQFp-00000000yA8-2ynM@gemulon.postgresql.org |
| Views: | Whole Thread | Raw Message | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-committers |
Check for USAGE privilege on the composite type in ALTER TABLE OF.
This omission allowed roles without USAGE on a type to create
tables that depend on it, which could prevent the owner from
changing the type later.
Reported-by: Nathan Bossart <nathandbossart(at)gmail(dot)com>
Author: Nathan Bossart <nathandbossart(at)gmail(dot)com>
Reviewed-by: Robert Haas <robertmhaas(at)gmail(dot)com>
Security: CVE-2026-6470
Backpatch-through: 14
Branch
------
REL_18_STABLE
Details
-------
https://git.postgresql.org/pg/commitdiff/57f59ca1d954f2de7ac3ef8971046778c955613a
Author: Nathan Bossart <nathan(at)postgresql(dot)org>
Modified Files
--------------
src/backend/commands/tablecmds.c | 5 +++++
src/test/regress/expected/privileges.out | 6 ++++++
src/test/regress/sql/privileges.sql | 5 +++++
3 files changed, 16 insertions(+)
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Noah Misch | 2026-08-10 13:41:26 | pgsql: Save/restore more lexer state when skipping text due to \if. |
| Previous Message | Noah Misch | 2026-08-10 13:41:24 | pgsql: Preserve the owner of extended statistics rebuilt by ALTER TABLE |