low2.5
CVE-2026-119377
SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only for the first joined table's USING column.
Impact
SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only for the first joined table's USING column. Attackers able to submit SQL can query a shared USING column in a RIGHT or FULL JOIN to read columns denied via sqlite3_set_authorizer() SQLITE_READ restrictions.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| SQLite | SQLite | before 3.54.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- https://abraxaslabs.tech/research/sqlite-fj-using-auth
- https://github.com/sqlite/sqlite
- https://github.com/sqlite/sqlite/blob/version-3.53.4/src/resolve.c#L775
- https://github.com/sqlite/sqlite/commit/5694c3bb2a6a40770ecd2f65910eea756734dfd8
- https://github.com/sqlite/sqlite/commit/7ff247c5b9ead3ad8a69c26d3fd264878e127237
- https://sqlite.org/bugs/info/2026-07-05T08:15:45Z
- https://sqlite.org/releaselog/3_54_0.html
- https://sqlite.org/src/info/2cb22877683680c1
- https://sqlite.org/src/info/bbd69ce274620008
- https://www.vulncheck.com/advisories/sqlite-before-3.54.0-authorizer-bypass-via-right-or-full-join-using