---
id: "CVE-2026-119377"
kind: "vulnerability"
aliases: ["CVE-2026-119377"]
title: "SQLite: USING column in joins skips read authorizer checks"
severity: "low"
cvss: 2.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["embedded-database", "package", "sqlite"]
not_affected_if: ["no-authorizer", "sqlite-3.54.0-or-later", "trusted-sql-only"]
published_at: "2026-10-30T12:16:36+00:00"
first_seen_at: "2026-10-30T12:30:23+00:00"
updated_at: "2026-10-30T12:34:12+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119377", "first_seen_at": "2026-10-30T12:30:23+00:00"}]
---

# SQLite: USING column in joins skips read authorizer checks

SQLite versions before 3.54.0 check the read authorizer only for the first joined table's USING column in certain joins. An attacker who can submit SQL can read columns that the authorizer was set to deny.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the SQLite library version in use with `sqlite3 --version`, or the bundled version of the application or language binding.
- Look for code that calls `sqlite3_set_authorizer()` to restrict SQLITE_READ access.

## Fix

- SQLite versions before `3.54.0` are affected; move to `3.54.0` or later.

## Timeline

- 2026-10-30T12:30:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119377

## From the sources

SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only for the first joined table's USING column. Attackers able to submit SQL can query a shared USING column in a RIGHT or FULL JOIN to read columns denied via sqlite3_set_authorizer() SQLITE_READ restrictions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_