PostgreSQL Data Exposure Due to INSERT ON CONFLICT Vulnerability

CVE-2017-15099

Summary

This vulnerability in PostgreSQL allows attackers to gain unauthorized access to sensitive table contents through the use of INSERT ... ON CONFLICT DO UPDATE commands. The flaw exists in PostgreSQL versions 10.x prior to 10.1, 9.6.x prior to 9.6.6, and 9.5.x prior to 9.5.10, where users lacking SELECT privileges can exploit INSERT and UPDATE capabilities to bypass row-level security policies, exposing data they are otherwise restricted from viewing. This could lead to significant confidentiality and integrity issues within affected database systems.

References