Description

Incorrect ownership assignment in PostgreSQL ALTER TABLE ALTER TYPE command reassigns ownership of dependent statistics objects to the current user. This wrongly allows the table owner to run DROP STATISTICS and ALTER STATISTICS via this improper ownership. It wrongly denies those commands to the prior statistics object owner. DROP TABLE remains able to remove statistics objects, so this exploit achieves nothing in many ownership arrangements. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.8",
  "pubDate": "2026-08-13T13:19:16.470Z",
  "pubdate": "2026-08-13T13:19:16.470Z",
  "executiveSummary": "An incorrect ownership assignment vulnerability exists within PostgreSQL when executing the ALTER TABLE ALTER TYPE command. This flaw improperly reassigns the ownership of dependent statistics objects to the current user executing the command, rather than maintaining the expected security context. The impact of this security issue allows a table owner to execute DROP STATISTICS and ALTER STATISTICS commands against objects they should not fully control, while simultaneously and wrongly denying those same administrative commands to the legitimate prior statistics object owner. Affected systems include PostgreSQL versions prior to 18.5, 17.11, 16.15, 15.19, and 14.24. The risk implications involve unauthorized privilege manipulation and denial of legitimate management capabilities over database statistics objects, although standard exploitation requires the ability to issue specific schema modification commands. While DROP TABLE operations can still remove dependent statistics objects regardless of this ownership assignment—potentially limiting the practical utility of the exploit in certain administrative setups—the flaw nevertheless violates strict database access control boundaries and privilege separation principles.",
  "technicalDetails": "The vulnerability stems from flawed permission and ownership propagation logic within the PostgreSQL database engine, specifically inside the subsystem handling the ALTER TABLE ALTER TYPE command. When a table schema or column type is altered, dependent database objects such as extended statistics should preserve their secure ownership hierarchies. However, the root cause is an improper ownership assignment implementation that forces the ownership of dependent statistics objects to be transferred to the current user executing the table alteration command. This unintended privilege shift introduces a security flaw characterized by improper access control and privilege mismanagement. The vulnerable component involves the internal command handler responsible for processing dependency remappings during table and type modifications. To exploit this condition, an attacker or unauthorized user must possess sufficient privileges to execute the ALTER TABLE ALTER TYPE command on a targeted table that contains dependent statistics objects owned by another database role. Once the command is issued, the database engine erroneously updates the system catalogs, specifically modifying the ownership records of the dependent statistics objects to match the session user. As a result of this attack flow, post-exploitation impact includes the table owner gaining unauthorized administrative control over the statistics objects, enabling them to execute DROP STATISTICS or ALTER STATISTICS. Conversely, the legitimate prior statistics object owner is wrongly stripped of their administrative privileges and denied the ability to manage their own database objects. Network exposure is dependent on database access permissions, and authentication as a database user with table alteration rights is required to trigger the underlying flaw. Although the DROP TABLE command remains fully capable of removing associated statistics objects irrespective of this improper ownership assignment—which mitigates the impact in certain shared ownership arrangements—the vulnerability still represents a significant breach of database object permission boundaries across all unpatched instances."
}