CVE-2026-119377
SQLite before 3.54.0 Authorizer Bypass via RIGHT or FULL JOIN USING
- State
- Published
- Severity
- 2.0 Low
- Published
- Oct 30, 2026
- Updated
- Oct 30, 2026
- Reserved
- Oct 30, 2026
Description
SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only for the first joined table's USING column. Attackers able to submit SQL can query a shared USING column in a RIGHT or FULL JOIN to read columns denied via sqlite3_set_authorizer() SQLITE_READ restrictions.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 2.0 Low | CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 2.5 Low | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N | VulnCheck |
Weaknesses
- CWE-863 Incorrect Authorization
Affected Products
| Product | Versions |
|---|---|
SQLiteSQLite |
|
References
- https://sqlite.org/bugs/info/2026-07-05T08:15:45Zissue-tracking
- https://sqlite.org/src/info/bbd69ce274620008patch
- https://github.com/sqlite/sqlite/commit/7ff247c5b9ead3ad8a69c26d3fd264878e127237patch
- https://sqlite.org/src/info/2cb22877683680c1patch
- https://github.com/sqlite/sqlite/commit/5694c3bb2a6a40770ecd2f65910eea756734dfd8patch
- https://github.com/sqlite/sqlite/blob/version-3.53.4/src/resolve.c#L775technical-description
- https://sqlite.org/releaselog/3_54_0.htmlrelease-notes
- https://abraxaslabs.tech/research/sqlite-fj-using-auththird-party-advisory
- https://github.com/sqlite/sqliteproduct
- VulnCheck Advisory: SQLite before 3.54.0 Authorizer Bypass via RIGHT or FULL JOIN USINGthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.