{"id":"CVE-2026-119377","aliases":[],"cve":{"records":[{"id":"CVE-2026-119377","source":"VulnCheck","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-30T00:57:05.903Z","published":"2026-10-30T11:30:41.921Z","modified":"2026-10-30T11:30:41.921Z"}],"publishers":[{"name":"VulnCheck","role":"CNA","organizationId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","modified":"2026-10-30T11:30:41.921Z"}],"references":[{"url":"https://sqlite.org/bugs/info/2026-07-05T08:15:45Z","tags":["issue-tracking"],"source":"VulnCheck"},{"url":"https://sqlite.org/src/info/bbd69ce274620008","tags":["patch"],"source":"VulnCheck"},{"url":"https://github.com/sqlite/sqlite/commit/7ff247c5b9ead3ad8a69c26d3fd264878e127237","tags":["patch"],"source":"VulnCheck"},{"url":"https://sqlite.org/src/info/2cb22877683680c1","tags":["patch"],"source":"VulnCheck"},{"url":"https://github.com/sqlite/sqlite/commit/5694c3bb2a6a40770ecd2f65910eea756734dfd8","tags":["patch"],"source":"VulnCheck"},{"url":"https://github.com/sqlite/sqlite/blob/version-3.53.4/src/resolve.c#L775","tags":["technical-description"],"source":"VulnCheck"},{"url":"https://sqlite.org/releaselog/3_54_0.html","tags":["release-notes"],"source":"VulnCheck"},{"url":"https://abraxaslabs.tech/research/sqlite-fj-using-auth","tags":["third-party-advisory"],"source":"VulnCheck"},{"url":"https://github.com/sqlite/sqlite","tags":["product"],"source":"VulnCheck"},{"url":"https://www.vulncheck.com/advisories/sqlite-before-3.54.0-authorizer-bypass-via-right-or-full-join-using","tags":["third-party-advisory"],"source":"VulnCheck"}],"weaknesses":[{"id":"CWE-863","description":"Incorrect Authorization","source":"VulnCheck"}],"applicability":[{"source":"VulnCheck","statements":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*","versionEndExcluding":"3.54.0"}]}]}]}],"prioritization":[]},"title":"SQLite before 3.54.0 Authorizer Bypass via RIGHT or FULL JOIN USING","titleSource":"VulnCheck","descriptionSource":"VulnCheck","description":"SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only for the first joined table's USING column. Attackers able to submit SQL can query a shared USING column in a RIGHT or FULL JOIN to read columns denied via sqlite3_set_authorizer() SQLITE_READ restrictions.","score":2.5,"severity":"low","published":"2026-10-30T11:30:41.921Z","modified":"2026-10-30T11:30:41.921Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"SQLite","name":"SQLite","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"3.54.0","versionType":"custom"}],"defaultStatus":"unaffected","cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-119377"}],"remediation":[],"references":["https://sqlite.org/bugs/info/2026-07-05T08:15:45Z","https://sqlite.org/src/info/bbd69ce274620008","https://github.com/sqlite/sqlite/commit/7ff247c5b9ead3ad8a69c26d3fd264878e127237","https://sqlite.org/src/info/2cb22877683680c1","https://github.com/sqlite/sqlite/commit/5694c3bb2a6a40770ecd2f65910eea756734dfd8","https://github.com/sqlite/sqlite/blob/version-3.53.4/src/resolve.c#L775","https://sqlite.org/releaselog/3_54_0.html","https://abraxaslabs.tech/research/sqlite-fj-using-auth","https://github.com/sqlite/sqlite","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-authorizer-bypass-via-right-or-full-join-using"],"sources":[{"name":"CVE","id":"CVE-2026-119377","modified":"2026-10-30T11:30:41.921Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-119377"}],"assessments":[{"source":"VulnCheck","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","score":2},{"source":"VulnCheck","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","score":2.5}],"sourceAffected":[],"observedAt":"2026-10-30T11:36:03.724Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T09:10:30.844Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":{"text":"SQLite before 3.54.0 has an authorization bypass vulnerability, allowing attackers who can submit SQL to query denied columns via RIGHT or FULL JOIN USING. The authorizer is only invoked for the first joined table's USING column. This affects SQLite versions less than 3.54.0.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T11:51:27.904Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-119377"}]}}