CVE-2024-10978
MediumSummary
Incorrect privilege assignment in PostgreSQL allows a less-privileged application user to view or change different rows than intended. The attack requires the application to use SET ROLE, SET SESSION AUTHORIZATION, or equivalent. The problem arises when application queries use partitioning.
Risk Assessment
An application user may gain unauthorized access to or modify data, violating access controls.
Recommendation
Update PostgreSQL to the patched version and avoid using SET ROLE/SET SESSION AUTHORIZATION in queries with partitioning without thorough testing.
Original NVD description (English source)
Incorrect privilege assignment in PostgreSQL allows a less-privileged application user to view or change different rows from those intended. An attack requires the application to use SET ROLE, SET SESSION AUTHORIZATION, or an equivalent feature. The problem arises when an application query uses pa