2.0 Low

CVE-2026-119377 SQLite before 3.54.0 Authorizer Bypass via RIGHT or FULL JOIN USING

Description

SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only for the first joined table's USING column. Attackers able to submit SQL can query a shared USING column in a RIGHT or FULL JOIN to read columns denied via sqlite3_set_authorizer() SQLITE_READ restrictions.

CVSS 4.0 detail

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Exploitable with local access to the machine, with an ordinary account and without any user action; the impact on data or service is limited.

Attack vector: Local
Attack complexity: Low
Attack requirements: Present
Privileges required: Low
Interaction: None
Confidentiality: Low
Integrity: None
Availability: None
Confidentiality of other systems: None
Integrity of other systems: None
Availability of other systems: None

Affected products and versions

Product	Affected versions	Fixed in
SQLite 3.54	earliest → < 3.54.0	3.54.0

References

sqlite.org sqlite.org
sqlite.org sqlite.org
github.com github.com
sqlite.org sqlite.org
github.com github.com
github.com github.com
sqlite.org sqlite.org
abraxaslabs.tech abraxaslabs.tech
github.com github.com
VulnCheck Advisory: SQLite before 3.54.0 Authorizer Bypass via RIGHT or FULL JOIN USING www.vulncheck.com

Timeline

Published October 30, 2026
Last modified November 5, 2026

The 18 CVEs of SQLite →

CVE-2026-119586 SQLite command-line shell through 3.54.1 contains a command injection vulnerability in the .recover command that emits… 8.5 High CVE-2026-119591 SQLite before 3.54.0 Stack Exhaustion via countOfViewOptimization() in VALUES Clause 6.8 Medium CVE-2026-119379 SQLite before 3.54.0 built with the session extension contains a heap buffer overflow vulnerability in… 8.5 High CVE-2026-119378 SQLite before 3.54.0 contains a use-after-free vulnerability in the R-Tree extension that allows attackers to make… 6.8 Medium

Track this CVE