CVE-2026-119377

Description

SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only for the first joined table's USING column. Attackers able to submit SQL can query a shared USING column in a RIGHT or FULL JOIN to read columns denied via sqlite3_set_authorizer() SQLITE_READ restrictions.

Metrics

CVSS 3.1

2.5 (LOW) Score source: NVD CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

CVSS 4.0

2.0 (LOW) Score source: CNA CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — exploit probability

0% (percentile: 2) as of 1 November 2026

CWE

CWE-863

References

• https://abraxaslabs.tech/research/sqlite-fj-using-auth
• https://github.com/sqlite/sqlite
• https://github.com/sqlite/sqlite/blob/version-3.53.4/src/resolve.c#L775
• https://github.com/sqlite/sqlite/commit/5694c3bb2a6a40770ecd2f65910eea756734dfd8
• https://github.com/sqlite/sqlite/commit/7ff247c5b9ead3ad8a69c26d3fd264878e127237
• https://sqlite.org/bugs/info/2026-07-05T08:15:45Z
• https://sqlite.org/releaselog/3_54_0.html
• https://sqlite.org/src/info/2cb22877683680c1
• https://sqlite.org/src/info/bbd69ce274620008
• https://www.vulncheck.com/advisories/sqlite-before-3.54.0-authorizer-bypass-via…