PostgreSQL Missing Authorization Vulnerability - CVE-2026-6470

Missing authorization in PostgreSQL DDL commands allows an object creator to achieve denial of service against ALTER and DROP of the type via creating a dependency on the type. Many DDL operations did check the privilege but assigning a range subtype and referencing the type from an SQL expression did not. Versions before PostgreSQL 18.5 17.11 16.15 15.19 and 14.24 are affected.