---
id: "CVE-2026-120146"
page: "https://infrastack.ai/live/CVE-2026-120146"
kind: "vulnerability"
aliases: ["CVE-2026-120146"]
title: "PostgreSQL: REASSIGN OWNED lets some roles take over objects they should not"
severity: "medium"
cvss: 4.3
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["database-admins", "postgresql", "runtime", "self-hosted"]
not_affected_if: ["managed-hosting", "simple-role-model"]
published_at: "2026-11-12T15:17:43+00:00"
first_seen_at: "2026-11-12T15:41:56+00:00"
updated_at: "2026-11-12T15:44:01+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120146", "first_seen_at": "2026-11-12T15:41:56+00:00"}]
exploit_sources: []
---

# PostgreSQL: REASSIGN OWNED lets some roles take over objects they should not

Link for people: https://infrastack.ai/live/CVE-2026-120146 (this .md is for agents)

PostgreSQL's REASSIGN OWNED command does not check authorization the way the ALTER ... OWNER commands do. A role that has INHERIT but not SET can move objects to the role it was granted, and can reassign database ownership without CREATEDB.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `psql -c "SELECT version();"` and compare the server version with the fixed releases below.
- Review which roles hold INHERIT membership in other roles without SET, using `\du` in psql.

## Fix

- Upgrade to `18.7`, `17.12`, `16.16`, `15.20` or `14.25` (the fixed release for your major version).

## Timeline

- 2026-11-12T15:41:56+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120146

## From the sources

Missing authorization in PostgreSQL REASSIGN OWNED allows a role granted INHERIT but not SET to transfer objects to the granted role.  It also allows reassignment of database ownership without the CREATEDB privilege.  The equivalent ALTER ... OWNER commands block this.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_