Request a Demo
Home   >   mailing lists

pgsql: Check for USAGE privilege on the composite type in ALTER TABLE O - Mailing list pgsql-committers

From Noah Misch
Subject pgsql: Check for USAGE privilege on the composite type in ALTER TABLE O
Date
Msg-id E1wtQFn-00000000y5V-0SbF@gemulon.postgresql.org
Whole thread
List pgsql-committers
Tree view 
Check for USAGE privilege on the composite type in ALTER TABLE OF.

This omission allowed roles without USAGE on a type to create
tables that depend on it, which could prevent the owner from
changing the type later.

Reported-by: Nathan Bossart <nathandbossart@gmail.com>
Author: Nathan Bossart <nathandbossart@gmail.com>
Reviewed-by: Robert Haas <robertmhaas@gmail.com>
Security: CVE-2026-6470
Backpatch-through: 14

Branch
------
REL_19_STABLE

Details
-------
https://git.postgresql.org/pg/commitdiff/bb1bc525dc01985efeda58a3e613e381146df6a7
Author: Nathan Bossart <nathan@postgresql.org>

Modified Files
--------------
src/backend/commands/tablecmds.c         | 5 +++++
src/test/regress/expected/privileges.out | 6 ++++++
src/test/regress/sql/privileges.sql      | 5 +++++
3 files changed, 16 insertions(+)
Attachment

pgsql-committers by date:

Previous
From: Noah Misch
Date:
Subject: pgsql: Return nulls honestly in aggregate "combine" functions.
Next
From: Noah Misch
Date:
Subject: pgsql: Use value of scram_iterations in mock_scram_secret().