Row Security Policy Flaw in PostgreSQL by PostgreSQL Global Development Group

CVE-2023-2455

Summary

This vulnerability arises from the failure of PostgreSQL to properly manage role-specific row security policies when user IDs change during query execution. In scenarios where role-specific policies are defined, such as using security definer functions or when switching between multiple roles, incorrect policy enforcement may occur. This allows unauthorized users to execute read and modification operations that should be restricted, exploiting instances where CREATE POLICY has been applied to define these security measures. Affected databases may inadvertently permit violations of intended access controls, putting sensitive data at risk.

References