Threats tagged 'ghsa-9pxp-38rf-5pgv'

CVE-2026-120154 is a vulnerability in PostgreSQL's INSERT ... ON CONFLICT feature that allows an attacker with INSERT, UPDATE, and applicable SELECT privileges on a table to read all rows in that table, bypassing row security policies. This issue affects PostgreSQL versions prior to 18.7, 17.12, 16.16, 15.20, and 14.25. Unlike a related vulnerability (CVE-2026-16237), this flaw does not allow unauthorized writes. The vulnerability has a medium severity with a CVSS score of 4.3.