Low severity2.5NVD Advisory· Published Oct 30, 2026
CVE-2026-119377
CVE-2026-119377
Description
SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only for the first joined table's USING column. Attackers able to submit SQL can query a shared USING column in a RIGHT or FULL JOIN to read columns denied via sqlite3_set_authorizer() SQLITE_READ restrictions.
Affected products
1Patches
Vulnerability mechanics
References
9- abraxaslabs.tech/research/sqlite-fj-using-authnvd
- github.com/sqlite/sqlite/blob/version-3.53.4/src/resolve.cnvd
- github.com/sqlite/sqlite/commit/5694c3bb2a6a40770ecd2f65910eea756734dfd8nvd
- github.com/sqlite/sqlite/commit/7ff247c5b9ead3ad8a69c26d3fd264878e127237nvd
- sqlite.org/bugs/info/2026-07-05T08:15:45Znvd
- sqlite.org/releaselog/3_54_0.htmlnvd
- sqlite.org/src/info/2cb22877683680c1nvd
- sqlite.org/src/info/bbd69ce274620008nvd
- www.vulncheck.com/advisories/sqlite-before-3.54.0-authorizer-bypass-via-right-or-full-join-usingnvd
News mentions
0No linked articles in our index yet.