CVE-2026-120146

MediumCVSS 4.3/10Last modified Nov 12, 2026

Description

Missing authorization in PostgreSQL REASSIGN OWNED allows a role granted INHERIT but not SET to transfer objects to the granted role. It also allows reassignment of database ownership without the CREATEDB privilege. The equivalent ALTER ... OWNER commands block this. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
n/a	PostgreSQL	>= 18, < 18.7; >= 17, < 17.12; >= 16, < 16.16; >= 15, < 15.20; < 14.25

References

https://www.postgresql.org/support/security/CVE-2026-120146/

Timeline

Published: Nov 12, 2026
Last modified: Nov 12, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1201478.8Use after free in the PostgreSQL dblink extension allows an object creator to execute arbitrary code as the operating system user running th CVE-2026-1201488.1Type confusion in PostgreSQL extended statistics allows an object creator to execute arbitrary code as the operating system user running the CVE-2026-1201498.8Heap-based buffer overflow in PostgreSQL foreign batch inserts allows a foreign server to execute arbitrary code, via reporting that it inse CVE-2026-120155.3Use after free in Autofill in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to ob CVE-2026-1201508.8Use after free in PostgreSQL expanded-record domain checks allows an object creator to execute arbitrary code as the operating system user r CVE-2026-1201518.8Type confusion in PostgreSQL plpgsql record-field assignment allows an object creator to execute arbitrary code as the operating system user CVE-2026-1201524.3Use after free in PostgreSQL pg_show_all_settings() allows a database user to retrieve memory contents, via loading a module while the funct CVE-2026-1201537.2SQL injection in PostgreSQL extension-script substitutions allows an attacker with database-level CREATE privilege to execute arbitrary code CVE-2026-1201544.3Improper protection in PostgreSQL INSERT ... ON CONFLICT allows an attacker having INSERT, UPDATE, and applicable SELECT privileges on the t CVE-2026-120168.3Inappropriate implementation in DevTools in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer CVE-2026-120173.1Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromised the render CVE-2026-120188.8Inappropriate implementation in Mojo in Google Chrome on Windows prior to 149.0.7827.115 allowed a local attacker to perform OS-level privil