Threats tagged 'ghsa-c93m-7254-wq8r'

A missing authorization check in PostgreSQL's DROP OWNED command allows a role to remove itself from restrictive row level security policies. This bypass enables the role to read or modify rows that the security policy was designed to restrict. Versions prior to PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.