CVE-2024-10976

Medium

Published: —Translated: 27/07/2026(UTC)NVD NIST

Summary

Incomplete tracking in PostgreSQL of tables with row security allows reused queries to view or change different rows than intended. Fixes for CVE-2023-2455 and CVE-2016-2193 missed cases involving subqueries, WITH queries, and security invoker views.

Risk Assessment

An application user may gain unauthorized access to or modify data, compromising confidentiality and integrity.

Recommendation

Update PostgreSQL to the patched version and review applications using subqueries and security invoker views.

Original NVD description (English source)

Incomplete tracking in PostgreSQL of tables with row security allows a reused query to view or change different rows from those intended. CVE-2023-2455 and CVE-2016-2193 fixed most interaction between row security and user ID changes. They missed cases where a subquery, WITH query, security invoke