Description

Missing authorization in PostgreSQL DDL commands allows an object creator to achieve denial of service against ALTER and DROP of the type, via creating a dependency on the type. Many DDL operations did check the privilege, but assigning a range subtype and referencing the type from an SQL expression did not. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-13T13:19:16.600Z",
  "pubdate": "2026-08-13T13:19:16.600Z",
  "executiveSummary": "A missing authorization vulnerability exists within PostgreSQL Data Definition Language (DDL) command processing, specifically concerning how object creation establishes dependencies on types. This flaw allows an authenticated object creator to induce a denial of service (DoS) condition against ALTER and DROP operations targeting specific types. The vulnerability impacts PostgreSQL versions prior to 18.5, 17.11, 16.15, 15.19, and 14.24.\nThe risk implication centers on availability disruption, where malicious or inadvertent dependency creation prevents database administrators or authorized owners from modifying or removing database types. The attacker capability requires the ability to create database objects and manipulate type dependencies, exploiting missing privilege validation checks during the assignment of range subtypes and the referencing of types within SQL expressions.\nExploitation relies on abusing standard object creation features to anchor unintended dependencies, effectively locking targeted types into dependent structures that block administrative lifecycle management commands.",
  "technicalDetails": "The root cause of the vulnerability stems from incomplete privilege verification during specific PostgreSQL DDL operations. While many DDL operations properly validate user privileges before allowing modifications, assigning a range subtype and referencing a type from an SQL expression failed to enforce the requisite authorization checks.\nThe vulnerable components reside within the PostgreSQL type dependency management and DDL command execution subsystems. Specifically, when users create range subtypes or incorporate type references in SQL expressions, the database engine establishes system catalog dependencies without adequately verifying whether the object creator holds sufficient administrative privileges over the referenced type.\nThe attack flow proceeds as follows: First, an unprivileged or standard user with object creation capabilities identifies a target type they do not own or possess administrative control over. Second, the user issues a DDL command to assign a range subtype or embeds a reference to the target type within an SQL expression. Third, the PostgreSQL backend processes the command, successfully registering a dependency relationship in the system catalogs (pg_depend) without executing the necessary privilege validation checks. Fourth, when an administrator or the legitimate type owner subsequently attempts to execute an ALTER or DROP command against the targeted type, the dependency tracking mechanism blocks the operation to preserve database integrity. This results in a denial of service against type maintenance and schema evolution tasks.\nThe affected versions include all PostgreSQL deployments prior to 18.5, 17.11, 16.15, 15.19, and 14.24. Exploitation requires authenticated access to the database with permissions to create objects and execute the specific DDL commands that instantiate the illicit dependencies."
}