PostgreSQL versions 14, 15, and 16 prior to 14.12, 15.7, and 16.3 respectively have a vulnerability in the built-in views pg_stats_ext and pg_stats_ext_exprs. These views lack proper authorization checks, allowing unprivileged database users to read statistical data, including most common values from CREATE STATISTICS commands of other users. This exposure may reveal sensitive column values or function results that the user should not access. The vulnerability affects existing installations unless they follow specific upgrade instructions. A patch is available to fix this issue.