The vulnerability CVE-2026-61821 affects pg_partman, a PostgreSQL extension for managing partitioned tables. Before version 5.5.0, the functions drop_partition_id() and drop_partition_time() use the part_config.retention_schema as the target schema for ALTER TABLE SET SCHEMA operations. These functions accept any nonempty schema name, and a role with partman_user access can specify a schema where it lacks CREATE privileges. The background worker then performs the schema relocation using pg_partman_bgw.role privileges, which default to PostgreSQL superuser. This bypasses the usual authorization checks, enabling unauthorized relocation of retained child tables between schemas. The vulnerability is addressed in version 5.5.0.

An attacker with partman_user role privileges can relocate retained child tables to arbitrary schemas without having the required CREATE privileges on those schemas. This bypass of authorization checks can lead to unauthorized data manipulation or access control violations. The CVSS 3.1 score is 8.5 (high), reflecting network attack vector, low attack complexity, required privileges, no user interaction, scope change, high confidentiality impact, low integrity impact, and no availability impact.

Upgrade pg_partman to version 5.5.0 or later, where this authorization bypass vulnerability is fixed. No other mitigations are indicated by the vendor advisory. Patch status is confirmed fixed in 5.5.0.