Vulnerability Description
SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only for the first joined table's USING column. Attackers able to submit SQL can query a shared USING column in a RIGHT or FULL JOIN to read columns denied via sqlite3_set_authorizer() SQLITE_READ restrictions.
CVSS Score
LOW
Related Weaknesses (CWE)
References
- https://abraxaslabs.tech/research/sqlite-fj-using-auth
- https://github.com/sqlite/sqlite
- https://github.com/sqlite/sqlite/blob/version-3.53.4/src/resolve.c#L775
- https://github.com/sqlite/sqlite/commit/5694c3bb2a6a40770ecd2f65910eea756734dfd8
- https://github.com/sqlite/sqlite/commit/7ff247c5b9ead3ad8a69c26d3fd264878e127237
- https://sqlite.org/bugs/info/2026-07-05T08:15:45Z
- https://sqlite.org/releaselog/3_54_0.html
- https://sqlite.org/src/info/2cb22877683680c1
- https://sqlite.org/src/info/bbd69ce274620008
- https://www.vulncheck.com/advisories/sqlite-before-3.54.0-authorizer-bypass-via-
FAQ
What is CVE-2026-119377?
CVE-2026-119377 is a vulnerability with a CVSS score of 2.5 (LOW). SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only for the first joined table's USING column. Attackers able to submit SQL can query a...
How severe is CVE-2026-119377?
CVE-2026-119377 has been rated LOW with a CVSS base score of 2.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-119377?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.