{"id":"CVE-2026-116303","kind":"vulnerability","aliases":["CVE-2026-116303"],"related":[],"title":"PostgreSQL: type conversion lets a database user run restricted cast functions","description":"Missing authorization in PostgreSQL type conversion allows a database user to invoke a cast function despite lacking EXECUTE privilege on that function, via foreign keys, to_json(), and others.  A successful attack requires the attacker to search each database for access-restricted cast functions and identify confidentiality impact specific to each function implementation found.  There are few or no practical examples of an access-restricted cast function or of a cast function having confidentiality impact.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.","summary":"PostgreSQL does not check EXECUTE privilege when certain type conversions (foreign keys, to_json() and others) invoke a cast function. A database user without EXECUTE rights on that cast function can still trigger it, which may expose data in rare cases.","severity":"low","cvss":3.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database","postgresql","runtime","self-hosted"],"not_affected_if":["no-restricted-cast-functions","patched-version"],"how_to_check":"- Check the PostgreSQL server version with `SELECT version();` and compare it to the fixed versions below.","fix":"- PostgreSQL `18.7`\n- PostgreSQL `17.12`\n- PostgreSQL `16.16`\n- PostgreSQL `15.20`\n- PostgreSQL `14.25`","status":"open","published_at":"2026-11-12T15:17:37+00:00","first_seen_at":"2026-11-12T15:41:53+00:00","triaged_at":"2026-11-12T15:44:06+00:00","updated_at":"2026-11-12T15:44:06+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-11-12T15:44:06Z","model":"claude-haiku-5-5","output":{"fix":"- PostgreSQL `18.7`\n- PostgreSQL `17.12`\n- PostgreSQL `16.16`\n- PostgreSQL `15.20`\n- PostgreSQL `14.25`","reach":"local","title":"PostgreSQL: type conversion lets a database user run restricted cast functions","impact":"low","summary":"PostgreSQL does not check EXECUTE privilege when certain type conversions (foreign keys, to_json() and others) invoke a cast function. A database user without EXECUTE rights on that cast function can still trigger it, which may expose data in rare cases.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["postgresql","self-hosted","database"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"A database user reads data through a restricted cast function","analyst_note":"","how_to_check":"- Check the PostgreSQL server version with `SELECT version();` and compare it to the fixed versions below.\n- unknown for other checks; the sources do not say which cast functions are restricted in a given database.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["patched-version","no-restricted-cast-functions"],"who_is_affected":"Systems running PostgreSQL versions before 18.7, 17.12, 16.16, 15.20 or 14.25 are affected. Exploitation requires a database user who has a login and must locate access-restricted cast functions with confidentiality impact, which the sources say are few or none in practice.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000746,"input_tokens":4639,"output_tokens":565,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-116303':14A,17A '-2026':13A,16A '14.25':150C '15.20':148C '16.16':147C '17.12':146C '18.7':145C 'access':106C,130C 'access-restrict':105C,129C 'affect':152C 'allow':71C 'attack':96C,99C 'author':66C 'case':64B 'cast':10A,42B,52B,78C,108C,132C,137C 'certain':31B 'check':27B 'confidenti':112C,140C 'convers':3A,33B,70C 'cve':12A,15A 'data':61B 'databas':6A,18B,45B,73C,103C 'despit':80C 'exampl':126C 'execut':28B,48B,82C 'expos':60B 'foreign':34B,88C 'found':119C 'function':11A,43B,53B,79C,86C,109C,117C,133C,138C 'host':23B 'identifi':111C 'impact':113C,141C 'implement':118C 'invok':40B,76C 'json':37B,91C 'key':35B,89C 'lack':81C 'let':4A 'may':59B 'miss':65C 'other':39B,93C 'postgresql':1A,19B,24B,68C,144C 'practic':125C 'privileg':29B,83C 'rare':63B 'requir':97C 'restrict':9A,107C,131C 'right':49B 'run':8A 'runtim':20B 'search':101C 'self':22B 'self-host':21B 'specif':114C 'still':55B 'success':95C 'trigger':56B 'type':2A,32B,69C 'user':7A,46B,74C 'version':142C 'via':87C 'without':47B","nicknames":[],"mitigations":[],"who_affected":"Systems running PostgreSQL versions before 18.7, 17.12, 16.16, 15.20 or 14.25 are affected. Exploitation requires a database user who has a login and must locate access-restricted cast functions with confidentiality impact, which the sources say are few or none in practice.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["database","low","postgresql","runtime","selfhosted"],"campaign_type":null,"search_a":"'-116303':14A,17A '-2026':13A,16A 'cast':10A 'convers':3A 'cve':12A,15A 'databas':6A 'function':11A 'let':4A 'postgresql':1A 'restrict':9A 'run':8A 'type':2A 'user':7A","search_b":"'case':64B 'cast':42B,52B 'certain':31B 'check':27B 'convers':33B 'data':61B 'databas':18B,45B 'execut':28B,48B 'expos':60B 'foreign':34B 'function':43B,53B 'host':23B 'invok':40B 'json':37B 'key':35B 'may':59B 'other':39B 'postgresql':19B,24B 'privileg':29B 'rare':63B 'right':49B 'runtim':20B 'self':22B 'self-host':21B 'still':55B 'trigger':56B 'type':32B 'user':46B 'without':47B","search_c":"'14.25':150C '15.20':148C '16.16':147C '17.12':146C '18.7':145C 'access':106C,130C 'access-restrict':105C,129C 'affect':152C 'allow':71C 'attack':96C,99C 'author':66C 'cast':78C,108C,132C,137C 'confidenti':112C,140C 'convers':70C 'databas':73C,103C 'despit':80C 'exampl':126C 'execut':82C 'foreign':88C 'found':119C 'function':79C,86C,109C,117C,133C,138C 'identifi':111C 'impact':113C,141C 'implement':118C 'invok':76C 'json':91C 'key':89C 'lack':81C 'miss':65C 'other':93C 'postgresql':68C,144C 'practic':125C 'privileg':83C 'requir':97C 'restrict':107C,131C 'search':101C 'specif':114C 'success':95C 'type':69C 'user':74C 'version':142C 'via':87C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T15:17:37+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116303","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116303","severity":null,"published_at":"2026-11-12T15:17:37+00:00","modified_at":"2026-11-12T15:17:37+00:00","first_seen_at":"2026-11-12T15:41:53+00:00","fetched_at":"2026-11-12T15:41:53+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}