This vulnerability arises from missing authorization in PostgreSQL's CREATE TYPE functionality. An attacker with the ability to create types can manipulate the search_path mechanism used by other queries to resolve user-defined or extension-defined types. Consequently, the victim's queries may execute arbitrary SQL functions specified by the attacker. Affected versions include all PostgreSQL releases before 18.4, 17.10, 16.14, 15.18, and 14.23. The CVSS v3.1 base score is 5.4, indicating medium severity with network attack vector, low attack complexity, requiring privileges, no user interaction, and impacting confidentiality and integrity with no availability impact. No vendor advisory or patch information is provided, and no known exploits in the wild are reported.

The vulnerability allows an attacker with the ability to create types in PostgreSQL to cause other users' queries that rely on search_path for type resolution to execute arbitrary SQL functions controlled by the attacker. This can lead to unauthorized information disclosure and modification of data integrity. There is no reported impact on availability. The attack requires some privileges (PR:L) and can be performed remotely (AV:N).

Patch status is not yet confirmed — check the official PostgreSQL vendor advisory for current remediation guidance. Until a patch is available, restrict the ability to create types to trusted users only and review database permissions to limit exposure.