CVE-2026-119377
2.5 LOWpublic exploit availablePublished 2026-10-30 · Updated 2026-10-30
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only for the first joined table's USING column. Attackers able to submit SQL can query a shared USING column in a RIGHT or FULL JOIN to read columns denied via sqlite3_set_authorizer() SQLITE_READ restrictions.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-863
Public exploit & PoC references
All references
- https://abraxaslabs.tech/research/sqlite-fj-using-auth
- https://github.com/sqlite/sqlite
- https://github.com/sqlite/sqlite/blob/version-3.53.4/src/resolve.c#L775
- https://github.com/sqlite/sqlite/commit/5694c3bb2a6a40770ecd2f65910eea756734dfd8
- https://github.com/sqlite/sqlite/commit/7ff247c5b9ead3ad8a69c26d3fd264878e127237
- https://sqlite.org/bugs/info/2026-07-05T08:15:45Z
- https://sqlite.org/releaselog/3_54_0.html
- https://sqlite.org/src/info/2cb22877683680c1
- https://sqlite.org/src/info/bbd69ce274620008
- https://www.vulncheck.com/advisories/sqlite-before-3.54.0-authorizer-bypass-via-right-or-full-join-using
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2024-22031PoC
- MEDIUMCVE-2025-13050PoC
- UNSCOREDCVE-2025-68392
- HIGHCVE-2026-100105
- MEDIUMCVE-2026-100145
- MEDIUMCVE-2026-100259
- HIGHCVE-2026-100262
- LOWCVE-2026-100270
Related by shared AI tags and CWE weakness class. Browse the full archive.