CVE-2026-119377 — Vulnerability intelligence

sqlite — sqlite

Published: 2026-10-30T12:16:36.650

CVSS

2

CISA KEV

Not listed; not proof of no exploitation

Original source text (not a translation)

SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only for the first joined table's USING column. Attackers able to submit SQL can query a shared USING column in a RIGHT or FULL JOIN to read columns denied via sqlite3_set_authorizer() SQLITE_READ restrictions.

Sources

• CVE-2026-119377
• Exploit, Third Party Advisory
• Product
• Product
• Patch
• Patch
• Issue Tracking, Vendor Advisory
• Release Notes
• Issue Tracking
• Issue Tracking
• Third Party Advisory