{"id":"CVE-2026-116311","kind":"vulnerability","aliases":["CVE-2026-116311"],"related":[],"title":"PostgreSQL: DROP OWNED lets a role bypass restrictive row-level security policies","description":"Missing authorization in PostgreSQL DROP OWNED allows a role to remove itself from restrictive row level security policies, thereby reading or modifying rows that the policy was intended to deny, via queries after the DROP OWNED.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.","summary":"PostgreSQL's DROP OWNED command lacks an authorization check, so a role can remove itself from restrictive row-level security policies. After that, the role can read or change rows the policy was meant to block.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["databases","postgresql","runtime"],"not_affected_if":["no-restrictive-rls-policies","patched-version"],"how_to_check":"- Check the server version with `SELECT version();` and compare it to the fixed releases below.\n- Look for restrictive row-level security policies with `SELECT * FROM pg_policies WHERE permissive = 'RESTRICTIVE';`.","fix":"- PostgreSQL `18.7`\n- PostgreSQL `17.12`\n- PostgreSQL `16.16`\n- PostgreSQL `15.20`\n- PostgreSQL `14.25`","status":"open","published_at":"2026-11-12T15:17:39+00:00","first_seen_at":"2026-11-12T15:41:54+00:00","triaged_at":"2026-11-12T15:43:56+00:00","updated_at":"2026-11-12T15:43:56+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-11-12T15:43:56Z","model":"claude-haiku-5-5","output":{"fix":"- PostgreSQL `18.7`\n- PostgreSQL `17.12`\n- PostgreSQL `16.16`\n- PostgreSQL `15.20`\n- PostgreSQL `14.25`","reach":"local","title":"PostgreSQL: DROP OWNED lets a role bypass restrictive row-level security policies","impact":"medium","summary":"PostgreSQL's DROP OWNED command lacks an authorization check, so a role can remove itself from restrictive row-level security policies. After that, the role can read or change rows the policy was meant to block.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["postgresql","databases"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"A database role reads or modifies rows its policy denied.","analyst_note":"","how_to_check":"- Check the server version with `SELECT version();` and compare it to the fixed releases below.\n- Look for restrictive row-level security policies with `SELECT * FROM pg_policies WHERE permissive = 'RESTRICTIVE';`.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-restrictive-rls-policies","patched-version"],"who_is_affected":"Servers running PostgreSQL versions before 18.7, 17.12, 16.16, 15.20 or 14.25 that use restrictive row-level security policies to limit what roles can see. The flaw lets a role that can run DROP OWNED strip its own policy restrictions. Systems that do not use restrictive row-level security policies are not exposed through this path.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000753,"input_tokens":4573,"output_tokens":592,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116311':16A,19A '-2026':15A,18A '14.25':104C '15.20':102C '16.16':101C '17.12':100C '18.7':99C 'affect':106C 'allow':66C 'author':30B,61C 'block':59B 'bypass':7A 'chang':52B 'check':31B 'command':27B 'cve':14A,17A 'databas':20B 'deni':89C 'drop':2A,25B,64C,94C 'intend':87C 'lack':28B 'let':4A 'level':11A,42B,75C 'meant':57B 'miss':60C 'modifi':81C 'own':3A,26B,65C,95C 'polici':13A,44B,55B,77C,85C 'postgresql':1A,21B,23B,63C,98C 'queri':91C 'read':50B,79C 'remov':36B,70C 'restrict':8A,39B,73C 'role':6A,34B,48B,68C 'row':10A,41B,53B,74C,82C 'row-level':9A,40B 'runtim':22B 'secur':12A,43B,76C 'therebi':78C 'version':96C 'via':90C","nicknames":[],"mitigations":[],"who_affected":"Servers running PostgreSQL versions before 18.7, 17.12, 16.16, 15.20 or 14.25 that use restrictive row-level security policies to limit what roles can see. The flaw lets a role that can run DROP OWNED strip its own policy restrictions. Systems that do not use restrictive row-level security policies are not exposed through this path.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["databases","medium","postgresql","runtime"],"campaign_type":null,"search_a":"'-116311':16A,19A '-2026':15A,18A 'bypass':7A 'cve':14A,17A 'drop':2A 'let':4A 'level':11A 'own':3A 'polici':13A 'postgresql':1A 'restrict':8A 'role':6A 'row':10A 'row-level':9A 'secur':12A","search_b":"'author':30B 'block':59B 'chang':52B 'check':31B 'command':27B 'databas':20B 'drop':25B 'lack':28B 'level':42B 'meant':57B 'own':26B 'polici':44B,55B 'postgresql':21B,23B 'read':50B 'remov':36B 'restrict':39B 'role':34B,48B 'row':41B,53B 'row-level':40B 'runtim':22B 'secur':43B","search_c":"'14.25':104C '15.20':102C '16.16':101C '17.12':100C '18.7':99C 'affect':106C 'allow':66C 'author':61C 'deni':89C 'drop':64C,94C 'intend':87C 'level':75C 'miss':60C 'modifi':81C 'own':65C,95C 'polici':77C,85C 'postgresql':63C,98C 'queri':91C 'read':79C 'remov':70C 'restrict':73C 'role':68C 'row':74C,82C 'secur':76C 'therebi':78C 'version':96C 'via':90C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T15:17:39+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","cvss_by":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116311","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116311","severity":null,"published_at":"2026-11-12T15:17:39+00:00","modified_at":"2026-11-12T15:17:39+00:00","first_seen_at":"2026-11-12T15:41:54+00:00","fetched_at":"2026-11-12T15:41:54+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}