Threats tagged 'ghsa-v5xq-4x8p-53j2'

A missing authorization check in PostgreSQL's REASSIGN OWNED command allows a role granted INHERIT but not SET privileges to transfer objects to the granted role. This flaw also permits reassignment of database ownership without requiring the CREATEDB privilege. The issue affects PostgreSQL versions prior to 18.7, 17.12, 16.16, 15.20, and 14.25. Equivalent ALTER ... OWNER commands do not exhibit this vulnerability.