CyberRota Analysis
AI-GeneratedPostgreSQL's ALTER TABLE ALTER TYPE command incorrectly assigns ownership of dependent statistics objects to the current user, allowing unauthorized execution of DROP STATISTICS and ALTER STATISTICS commands. This vulnerability primarily affects versions prior to PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24, and while it poses a low severity risk, database administrators should prioritize patching to prevent potential misuse of statistics management. Organizations using affected PostgreSQL versions should assess their database environments to mitigate any risks associated with improper ownership assignments.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Incorrect ownership assignment in PostgreSQL ALTER TABLE ALTER TYPE command reassigns ownership of dependent statistics objects to the current user. This wrongly allows the table owner to run DROP STATISTICS and ALTER STATISTICS via this improper ownership. It wrongly denies those commands to the prior statistics object owner. DROP TABLE remains able to remove statistics objects, so this exploit achieves nothing in many ownership arrangements. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.