Request a Demo
Home   >   mailing lists

pgsql: Check for USAGE privilege on the composite type in ALTER TABLE O - Mailing list pgsql-committers

From Noah Misch
Subject pgsql: Check for USAGE privilege on the composite type in ALTER TABLE O
Date
Msg-id E1wtQFs-00000000yEG-0qg4@gemulon.postgresql.org
Whole thread
List pgsql-committers
Tree view 
Check for USAGE privilege on the composite type in ALTER TABLE OF.

This omission allowed roles without USAGE on a type to create
tables that depend on it, which could prevent the owner from
changing the type later.

Reported-by: Nathan Bossart <nathandbossart@gmail.com>
Author: Nathan Bossart <nathandbossart@gmail.com>
Reviewed-by: Robert Haas <robertmhaas@gmail.com>
Security: CVE-2026-6470
Backpatch-through: 14

Branch
------
REL_17_STABLE

Details
-------
https://git.postgresql.org/pg/commitdiff/67135960559d5e623757ffa8ec0ab4d94293dfc2
Author: Nathan Bossart <nathan@postgresql.org>

Modified Files
--------------
src/backend/commands/tablecmds.c         | 5 +++++
src/test/regress/expected/privileges.out | 6 ++++++
src/test/regress/sql/privileges.sql      | 5 +++++
3 files changed, 16 insertions(+)

pgsql-committers by date:

Previous
From: Noah Misch
Date:
Subject: pgsql: Cross-check the type of a portal running EXECUTE or FETCH.
Next
From: Noah Misch
Date:
Subject: pgsql: Use value of scram_iterations in mock_scram_secret().