CVE-2026-119377
SQLite before 3.54.0 Authorizer Bypass via RIGHT or FULL JOIN USING
CVSS Score
2.5
EPSS Score
0.0%
EPSS Percentile
0th
SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only for the first joined table's USING column. Attackers able to submit SQL can query a shared USING column in a RIGHT or FULL JOIN to read columns denied via sqlite3_set_authorizer() SQLITE_READ restrictions.
| CWE | CWE-863 |
| Vendor | sqlite |
| Product | sqlite |
| Published | Oct 30, 2026 |
Stay Ahead of the Next One
Get instant alerts for sqlite sqlite
Be the first to know when new low vulnerabilities affecting sqlite sqlite are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N Attack Vector
Local
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Affected Versions
SQLite / SQLite
0 < 3.54.0
References
sqlite.org: https://sqlite.org/bugs/info/2026-07-05T08:15:45Z sqlite.org: https://sqlite.org/src/info/bbd69ce274620008 github.com: https://github.com/sqlite/sqlite/commit/7ff247c5b9ead3ad8a69c26d3fd264878e127237 sqlite.org: https://sqlite.org/src/info/2cb22877683680c1 github.com: https://github.com/sqlite/sqlite/commit/5694c3bb2a6a40770ecd2f65910eea756734dfd8 github.com: https://github.com/sqlite/sqlite/blob/version-3.53.4/src/resolve.c#L775 sqlite.org: https://sqlite.org/releaselog/3_54_0.html abraxaslabs.tech: https://abraxaslabs.tech/research/sqlite-fj-using-auth github.com: https://github.com/sqlite/sqlite vulncheck.com: https://www.vulncheck.com/advisories/sqlite-before-3.54.0-authorizer-bypass-via-right-or-full-join-using
Credits
ylwang 🔍 Abraxas Labs D. Richard Hipp