Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
PostgreSQL Missing Authorization Vulnerability (CVE-2026-6471) - Vulnerability Database

PostgreSQL Missing Authorization Vulnerability (CVE-2026-6471)

Description

Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen any file visible to the operating system account running the server, via the choice of logical decoding plugin. This in turn runs arbitrary code as that account. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

References

CVE-2026-6471

Related Vulnerabilities

Envoy Proxy Improper Handling of Highly Compressed Data (Data Amplification) Vulnerability (CVE-2022-29225) High
Common tags: Missing Update Known Vulnerabilities
phpBB Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2020-5502) Medium
Common tags: Missing Update Known Vulnerabilities
Next.js Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2020-5284) Medium
Common tags: Missing Update Known Vulnerabilities
PrestaShop Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-5285) Medium
Common tags: Missing Update Known Vulnerabilities
PrestaShop Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-5286) Medium
Common tags: Missing Update Known Vulnerabilities

Severity

High

Classification

CVE-2026-6471
CWE-862
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update
Known Vulnerabilities