Threats tagged 'ghsa-5xwq-5r59-wqjw'

A missing authorization check in PostgreSQL type conversion allows database users to invoke cast functions without having EXECUTE privilege on those functions. This can occur via mechanisms such as foreign keys and the to_json() function. Exploitation requires an attacker to identify access-restricted cast functions and assess confidentiality impact, which is reportedly rare or minimal. Versions prior to PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected. The vulnerability has a low CVSS score and no known exploits in the wild.