Live › vulnerability › CVE-2026-119377
SQLite versions before 3.54.0 check the read authorizer only for the first joined table's USING column in certain joins. An attacker who can submit SQL can read columns that the authorizer was set to deny.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 12:30 UTC. All times on this page are UTC.
Applications that embed SQLite, let untrusted users submit SQL, and rely on sqlite3_set_authorizer() SQLITE_READ restrictions to hide columns. Systems that do not use an authorizer or accept only trusted SQL are unlikely to be exposed.
No product ranges from the sources yet.
sqlite3 --version, or the bundled version of the application or language binding.sqlite3_set_authorizer() to restrict SQLITE_READ access.3.54.0 are affected; move to 3.54.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only for the first joined table's USING column. Attackers able to submit SQL can query a shared USING column in a RIGHT or FULL JOIN to read columns denied via sqlite3_set_authorizer() SQLITE_READ restrictions.
This page as .md · .json · in your agent: get_signal("CVE-2026-119377")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.