Authorization Bypass in SQLite Affects Shared Join Columns
CVE-2026-119377

2LOW

Key Information:

Vendor

Sqlite

Status
Sqlite
Vendor
CVE Published:
30 October 2026

What is CVE-2026-119377?

SQLite versions earlier than 3.54.0 have a vulnerability in lookupName() that allows an authorization bypass. This occurs as the authorizer is invoked only for the first joined table's USING column. Attackers with the ability to submit SQL commands can exploit this flaw by querying a shared USING column in a RIGHT or FULL JOIN, potentially accessing data that should be restricted by sqlite3_set_authorizer() settings. This vulnerability poses a significant risk as it undermines the intended data access controls.

Affected Version(s)

SQLite 0 < 3.54.0

References

https://sqlite.org/bugs/info/2026-07-05T08:15:45Z
issue-tracking
https://sqlite.org/src/info/bbd69ce274620008
patch
https://github.com/sqlite/sqlite/commit/7ff247c5b9ead3ad8...
patch

CVSS V4

Score:
2
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

ylwang
Abraxas Labs
D. Richard Hipp
.