CVE-2026-6469
Incorrect ownership assignment in PostgreSQL ALTER TABLE ALTER TYPE command reassigns ownership of dependent statistics objects to the current user. This wrongly allows the table owner to run DROP STATISTICS and ALTER STATISTICS via this improper ownership. It wrongly denies those commands to the prior statistics object owner. DROP TABLE remains able to remove statistics objects, so this exploit achieves nothing in many ownership arrangements. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.
Scoring
- Severity
- LOW
- CVSS base score
- 3.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L
- EPSS probability
- 0.19%
- CWE
- CWE-708
- Published
- 2026-08-13
- Last modified
- 2026-08-29
Affected products
- n/a PostgreSQL
- n/a PostgreSQL
- n/a PostgreSQL
- n/a PostgreSQL
- n/a PostgreSQL
Weakness type
Related vulnerabilities
- CVE-2026-40196 — HomeBox has Unauthorized API Access via Retained defaultGroup ID After Group Access Revocation
- CVE-2026-32691 — Timing ownership claim attack on new external back-end secrets
- CVE-2025-5467 — Ubuntu Apport Insecure File Permissions Vulnerability
- CVE-2025-14262 — Jobs can be saved as workflows with wrong permissions on KNIME Business Hub
- CVE-2025-5069 — Incorrect Ownership Assignment in GitLab
- CVE-2024-52561 — A privilege escalation vulnerability exists in the Snapshot functionality of Parallels Desktop for...
- CVE-2024-45417 — Zoom Apps for macOS - Uncontrolled Resource Consumption
- CVE-2024-45426 — Zoom Workplace Apps - Incorrect Ownership Assignment