{"id":"CVE-2026-119377","kind":"vulnerability","aliases":["CVE-2026-119377"],"related":[],"title":"SQLite: USING column in joins skips read authorizer checks","description":"SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only for the first joined table's USING column. Attackers able to submit SQL can query a shared USING column in a RIGHT or FULL JOIN to read columns denied via sqlite3_set_authorizer() SQLITE_READ restrictions.","summary":"SQLite versions before 3.54.0 check the read authorizer only for the first joined table's USING column in certain joins. An attacker who can submit SQL can read columns that the authorizer was set to deny.","severity":"low","cvss":2.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded-database","package","sqlite"],"not_affected_if":["no-authorizer","sqlite-3.54.0-or-later","trusted-sql-only"],"how_to_check":"- Check the SQLite library version in use with `sqlite3 --version`, or the bundled version of the application or language binding.\n- Look for code that calls `sqlite3_set_authorizer()` to restrict SQLITE_READ access.","fix":"- SQLite versions before `3.54.0` are affected; move to `3.54.0` or later.","status":"open","published_at":"2026-10-30T12:16:36+00:00","first_seen_at":"2026-10-30T12:30:23+00:00","triaged_at":"2026-10-30T12:34:12+00:00","updated_at":"2026-10-30T12:34:12+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-30T12:34:12Z","model":"claude-haiku-5-5","output":{"fix":"- SQLite versions before `3.54.0` are affected; move to `3.54.0` or later.","reach":"unknown","title":"SQLite: USING column in joins skips read authorizer checks","impact":"medium","summary":"SQLite versions before 3.54.0 check the read authorizer only for the first joined table's USING column in certain joins. An attacker who can submit SQL can read columns that the authorizer was set to deny.","audience":"developers","category":"package","nicknames":[],"who_cares":["sqlite","embedded-database"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker reads columns that the authorizer was meant to deny.","analyst_note":"","how_to_check":"- Check the SQLite library version in use with `sqlite3 --version`, or the bundled version of the application or language binding.\n- Look for code that calls `sqlite3_set_authorizer()` to restrict SQLITE_READ access.","plain_action":"","needs_analyst":false,"not_affected_if":["no-authorizer","trusted-sql-only","sqlite-3.54.0-or-later"],"who_is_affected":"Applications that embed SQLite, let untrusted users submit SQL, and rely on sqlite3_set_authorizer() SQLITE_READ restrictions to hide columns. Systems that do not use an authorizer or accept only trusted SQL are unlikely to be exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000679,"input_tokens":4150,"output_tokens":528,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-119377':12A,15A '-2026':11A,14A '3.54.0':24B,59C 'abl':81C 'attack':42B,80C 'author':8A,28B,52B,62C,70C,104C 'bypass':63C 'certain':39B 'check':9A,25B 'column':3A,37B,49B,79C,90C,99C 'contain':60C 'cve':10A,13A 'databas':18B 'deni':56B,100C 'embed':17B 'embedded-databas':16B 'first':32B,74C 'full':95C 'invok':68C 'join':5A,33B,40B,75C,96C 'lookupnam':66C 'packag':19B 'queri':86C 'read':7A,27B,48B,98C,106C 'restrict':107C 'right':93C 'set':54B,103C 'share':88C 'skip':6A 'sql':46B,84C 'sqlite':1A,20B,21B,57C,105C 'sqlite3':102C 'submit':45B,83C 'tabl':34B,76C 'use':2A,36B,78C,89C 'version':22B 'via':101C 'vulner':64C","nicknames":[],"mitigations":[],"who_affected":"Applications that embed SQLite, let untrusted users submit SQL, and rely on sqlite3_set_authorizer() SQLITE_READ restrictions to hide columns. Systems that do not use an authorizer or accept only trusted SQL are unlikely to be exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T12:16:36+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119377","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119377","severity":null,"published_at":"2026-10-30T12:16:36+00:00","modified_at":"2026-10-30T12:16:36+00:00","first_seen_at":"2026-10-30T12:30:23+00:00","fetched_at":"2026-10-30T12:30:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}