| From: | Noah Misch <noah(at)leadboat(dot)com> |
|---|---|
| To: | pgsql-committers(at)lists(dot)postgresql(dot)org |
| Subject: | pgsql: Check for USAGE privilege on the composite type in ALTER TABLE O |
| Date: | 2026-08-10 13:41:31 |
| Message-ID: | E1wtQFv-00000000yM1-3ABg@gemulon.postgresql.org |
| Views: | Whole Thread | Raw Message | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-committers |
Check for USAGE privilege on the composite type in ALTER TABLE OF.
This omission allowed roles without USAGE on a type to create
tables that depend on it, which could prevent the owner from
changing the type later.
Reported-by: Nathan Bossart <nathandbossart(at)gmail(dot)com>
Author: Nathan Bossart <nathandbossart(at)gmail(dot)com>
Reviewed-by: Robert Haas <robertmhaas(at)gmail(dot)com>
Security: CVE-2026-6470
Backpatch-through: 14
Branch
------
REL_15_STABLE
Details
-------
https://git.postgresql.org/pg/commitdiff/c062734cdb8a7a966f4e39bda47279b9178f5da0
Author: Nathan Bossart <nathan(at)postgresql(dot)org>
Modified Files
--------------
src/backend/commands/tablecmds.c | 5 +++++
src/test/regress/expected/privileges.out | 6 ++++++
src/test/regress/sql/privileges.sql | 5 +++++
3 files changed, 16 insertions(+)
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Noah Misch | 2026-08-10 13:41:32 | pgsql: psql: Don't do backquote expansion in \unrestrict. |
| Previous Message | Noah Misch | 2026-08-10 13:41:30 | pgsql: pgcrypto: Add option to revert to prior decryption behavior |