{"id":"CVE-2026-120146","kind":"vulnerability","aliases":["CVE-2026-120146"],"related":[],"title":"PostgreSQL: REASSIGN OWNED lets some roles take over objects they should not","description":"Missing authorization in PostgreSQL REASSIGN OWNED allows a role granted INHERIT but not SET to transfer objects to the granted role.  It also allows reassignment of database ownership without the CREATEDB privilege.  The equivalent ALTER ... OWNER commands block this.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.","summary":"PostgreSQL's REASSIGN OWNED command does not check authorization the way the ALTER ... OWNER commands do. A role that has INHERIT but not SET can move objects to the role it was granted, and can reassign database ownership without CREATEDB.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database-admins","postgresql","runtime","self-hosted"],"not_affected_if":["managed-hosting","simple-role-model"],"how_to_check":"- Run `psql -c \"SELECT version();\"` and compare the server version with the fixed releases below.\n- Review which roles hold INHERIT membership in other roles without SET, using `\\du` in psql.","fix":"- Upgrade to `18.7`, `17.12`, `16.16`, `15.20` or `14.25` (the fixed release for your major version).","status":"open","published_at":"2026-11-12T15:17:43+00:00","first_seen_at":"2026-11-12T15:41:56+00:00","triaged_at":"2026-11-12T15:44:01+00:00","updated_at":"2026-11-12T15:44:01+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-12T15:44:01Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade to `18.7`, `17.12`, `16.16`, `15.20` or `14.25` (the fixed release for your major version).","reach":"local","title":"PostgreSQL: REASSIGN OWNED lets some roles take over objects they should not","impact":"medium","summary":"PostgreSQL's REASSIGN OWNED command does not check authorization the way the ALTER ... OWNER commands do. A role that has INHERIT but not SET can move objects to the role it was granted, and can reassign database ownership without CREATEDB.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["postgresql","self-hosted","database-admins"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"A low-privileged role takes ownership of objects and databases it should not control.","analyst_note":"","how_to_check":"- Run `psql -c \"SELECT version();\"` and compare the server version with the fixed releases below.\n- Review which roles hold INHERIT membership in other roles without SET, using `\\du` in psql.\n- unknown for any other check, the sources do not say.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["managed-hosting","simple-role-model"],"who_is_affected":"Teams running self-hosted or managed PostgreSQL servers older than 18.7, 17.12, 16.16, 15.20 or 14.25. The exposure requires a role that has INHERIT membership without SET, so databases with a simple role layout are less exposed. Managed hosting providers patch on their own schedule.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000762,"input_tokens":4603,"output_tokens":603,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120146':12A,15A '-2026':11A,14A '14.25':111C '15.20':109C '16.16':108C '17.12':107C '18.7':106C 'admin':18B 'affect':113C 'allow':70C,87C 'also':86C 'alter':36B,98C 'author':32B,65C 'block':101C 'check':31B 'command':28B,38B,100C 'createdb':63B,94C 'cve':10A,13A 'databas':17B,60B,90C 'database-admin':16B 'equival':97C 'grant':56B,73C,83C 'host':23B 'inherit':44B,74C 'let':4A 'miss':64C 'move':49B 'object':9A,50B,80C 'own':3A,27B,69C 'owner':37B,99C 'ownership':61B,91C 'postgresql':1A,19B,24B,67C,105C 'privileg':95C 'reassign':2A,26B,59B,68C,88C 'role':6A,41B,53B,72C,84C 'runtim':20B 'self':22B 'self-host':21B 'set':47B,77C 'take':7A 'transfer':79C 'version':103C 'way':34B 'without':62B,92C","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted or managed PostgreSQL servers older than 18.7, 17.12, 16.16, 15.20 or 14.25. The exposure requires a role that has INHERIT membership without SET, so databases with a simple role layout are less exposed. Managed hosting providers patch on their own schedule.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["databaseadmins","medium","postgresql","runtime","selfhosted"],"campaign_type":null,"search_a":"'-120146':12A,15A '-2026':11A,14A 'cve':10A,13A 'let':4A 'object':9A 'own':3A 'postgresql':1A 'reassign':2A 'role':6A 'take':7A","search_b":"'admin':18B 'alter':36B 'author':32B 'check':31B 'command':28B,38B 'createdb':63B 'databas':17B,60B 'database-admin':16B 'grant':56B 'host':23B 'inherit':44B 'move':49B 'object':50B 'own':27B 'owner':37B 'ownership':61B 'postgresql':19B,24B 'reassign':26B,59B 'role':41B,53B 'runtim':20B 'self':22B 'self-host':21B 'set':47B 'way':34B 'without':62B","search_c":"'14.25':111C '15.20':109C '16.16':108C '17.12':107C '18.7':106C 'affect':113C 'allow':70C,87C 'also':86C 'alter':98C 'author':65C 'block':101C 'command':100C 'createdb':94C 'databas':90C 'equival':97C 'grant':73C,83C 'inherit':74C 'miss':64C 'object':80C 'own':69C 'owner':99C 'ownership':91C 'postgresql':67C,105C 'privileg':95C 'reassign':68C,88C 'role':72C,84C 'set':77C 'transfer':79C 'version':103C 'without':92C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T15:17:43+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvss_by":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120146","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120146","severity":null,"published_at":"2026-11-12T15:17:43+00:00","modified_at":"2026-11-12T15:17:43+00:00","first_seen_at":"2026-11-12T15:41:56+00:00","fetched_at":"2026-11-12T15:41:56+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}