Local Information Disclosure in SQLite by Vendor SQLite
CVE-2026-50813

6.1MEDIUM

Key Information:

Vendor

SQLite

Status
SQLite
Vendor
CVE Published:
8 July 2026

What is CVE-2026-50813?

A vulnerability in SQLite prior to Fossil check-in 869a51ae84df allows local attackers to exploit the Session Extension changeset functionality. By manipulating the concat/changegroup merge path, attackers can gain unauthorized access to sensitive information stored within SQLite databases, which could lead to further exploitation or exposure of confidential data.

References

https://sqlite.org/src/info/869a51ae84df
https://github.com/sqlite/sqlite/commit/c597ed79d1bd03f57...
https://gist.github.com/junius-sec/f8acb66bafb80134c8e1a1...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.