CVE-2023-2455
While CVE-2016-2193 fixed most interaction between row security and user ID changes, it missed a scenario involving function inlining. This leads to potentially incorrect policies being applied in cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security definer functions or when a common user and query is planned initially and then re-used across multiple SET ROLE s. Applying an incorrect policy may permit a user to complete otherwise-forbidden reads and modifications. This affects only databases that have used CREATE POLICY to define a row security policy. The PostgreSQL project thanks Wolfgang Walther for reporting this problem.
Version Information
| Affected branch | Introduced | Fixed In | Fix Published |
|---|---|---|---|
| 11 | — | 11.20 | 2023-05-11 |
| 12 | — | 12.15 | 2023-05-11 |
| 13 | — | 13.11 | 2023-05-11 |
| 14 | — | 14.8 | 2023-05-11 |
| 15 | — | 15.3 | 2023-05-11 |
CVSS 3.0
| Overall Score | 4.2 |
|---|---|
| Component | core server |
| Vector | AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N |
First published: 2023-05-11
Historical source observations
These dated records preserve the original source claims separately from the reviewed fix list.
center · 2026-10-03 12:08:35.169032+08
- PostgreSQL 15 · Original minor coordinate: 3
- PostgreSQL 14 · Original minor coordinate: 8
pgweb · 2026-10-03 12:08:55.967155+08
- PostgreSQL 15 · Original minor coordinate: 3
- PostgreSQL 14 · Original minor coordinate: 8