WarehousePG 7.x before 7.6.0-WHPG suffers from a missing authorization vulnerability in built-in server-side file functions pg_file_write(text,text,bool), pg_file_rename(text,text,text), pg_file_unlink(text), and pg_logdir_ls(). These functions are callable by any authenticated database role without requiring GRANT permissions because the REVOKE protections from the contrib/adminpack were not applied after merging with PostgreSQL 12. Non-superusers can manipulate files in data and log directories, including appending malicious directives to postgresql.auto.conf, enabling arbitrary code execution as the postgres OS user upon server restart or reload. WarehousePG 6.x is unaffected as it enforces superuser checks internally.

An attacker with any authenticated database role can exploit this vulnerability to manipulate critical files within the data and log directories. This includes creating, overwriting, renaming, and deleting files, as well as enumerating log files. By appending malicious configuration directives to postgresql.auto.conf, the attacker can achieve arbitrary code execution as the postgres operating system user after the next server restart or configuration reload. This represents a high-severity risk due to the potential for full system compromise.

No explicit patch or fix is stated in the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated database roles to trusted users only. Monitor vendor communications for official patches or updates addressing this missing authorization vulnerability.