CVE-2026-119377
SQLite before 3.54.0 Authorizer Bypass via RIGHT or FULL JOIN USING
SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only for the first joined table's USING column. Attackers able to submit SQL can query a shared USING column in a RIGHT or FULL JOIN to read columns denied via sqlite3_set_authorizer() SQLITE_READ restrictions.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
SQLite before 3.54.0 Authorizer Bypass via RIGHT or FULL JOIN USING
SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only for the first joined table's USING column. Attackers able to submit SQL can query a shared USING column in a RIGHT or FULL JOIN to read columns denied via sqlite3_set_authorizer() SQLITE_READ restrictions.
- Record
CVE-2026-119377- CVSS 4.0
- 2.0 Low
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 2.5 Low
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-863
- Updated
- 2026-11-05
EUVDEUVD-2026-113788
SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only for the first joined table's USING column. Attackers able to submit SQL can query a shared USING column in a RIGHT or FULL JOIN to read columns denied via sqlite3_set_authorizer() SQLITE_READ restrictions.
- Record
EUVD-2026-113788- CVSS 4.0
- 2.0 Low
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-05
GitHub AdvisoriesGHSA-qqg5-vxjp-68gf
SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes...
SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only for the first joined table's USING column. Attackers able to submit SQL can query a shared USING column in a RIGHT or FULL JOIN to read columns denied via sqlite3_set_authorizer() SQLITE_READ restrictions.
- Record
GHSA-qqg5-vxjp-68gf- CVSS 4.0
- 2.0 Low
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 2.5 Low
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-863
- Updated
- 2026-11-02
NVD
SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only for the first joined table's USING column. Attackers able to submit SQL can query a shared USING column in a RIGHT or FULL JOIN to read columns denied via sqlite3_set_authorizer() SQLITE_READ restrictions.
- Record
CVE-2026-119377- CVSS 4.0
- 2.0 Low
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 2.5 Low
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N - CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-863
- Updated
- 2026-11-05
OSV
SQLite before 3.54.0 Authorizer Bypass via RIGHT or FULL JOIN USING
SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only for the first joined table's USING column. Attackers able to submit SQL can query a shared USING column in a RIGHT or FULL JOIN to read columns denied via sqlite3_set_authorizer() SQLITE_READ restrictions.
- Record
CVE-2026-119377- CVSS 4.0
- 2.0 Low
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-863
- Updated
- 2026-11-07
OSVDEBIAN-CVE-2026-119377
SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only for the first joined table's USING column. Attackers able to submit SQL can query a shared USING column in a RIGHT or FULL JOIN to read columns denied via sqlite3_set_authorizer() SQLITE_READ restrictions.
- Record
DEBIAN-CVE-2026-119377- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-06
OSVUBUNTU-CVE-2026-119377
SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only for the first joined table's USING column. Attackers able to submit SQL can query a shared USING column in a RIGHT or FULL JOIN to read columns denied via sqlite3_set_authorizer() SQLITE_READ restrictions.
- Record
UBUNTU-CVE-2026-119377- CVSS 4.0
- 2.0 Low
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - CVSS 3.1
- 2.5 Low
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-05
OSVAZL-111781 No score
CVE-2026-119377 affecting package sqlite 3.44.0-4
SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only for the first joined table's USING column. Attackers able to submit SQL can query a shared USING column in a RIGHT or FULL JOIN to read columns denied via sqlite3_set_authorizer() SQLITE_READ restrictions.
- Record
AZL-111781- Updated
- 2026-11-05
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
sqliteAzure Linux:3 |
through 3.44.0-4 | None known |
sqlite3Debian:12 |
All versions, plus listed versions 3.40.1-23.40.1-2+deb12u13.40.1-2+deb12u23.42.0-13.43.0-1 Show 26 moreShow less3.43.1-13.43.2-13.44.0-13.44.2-13.45.0-13.45.1-13.45.2-13.45.3-13.45.3-2~exp13.46.0-13.46.1-13.46.1-23.46.1-2~exp3.46.1-33.46.1-43.46.1-53.46.1-63.46.1-73.46.1-83.46.1-93.53.2-13.53.3-13.53.4-13.53.4-23.54.1-13.54.1-2 |
None known |
sqlite3Debian:13 |
All versions, plus listed versions 3.46.1-73.46.1-7+deb13u13.46.1-7+deb13u23.46.1-83.46.1-9 Show 6 moreShow less3.53.2-13.53.3-13.53.4-13.53.4-23.54.1-13.54.1-2 |
None known |
sqlite3Debian:14 |
All versions, plus listed versions 3.46.1-73.46.1-83.46.1-93.53.2-13.53.3-1 Show 4 moreShow less3.53.4-13.53.4-23.54.1-13.54.1-2 |
None known |
sqliteUbuntu:14.04:LTS |
All versions, plus listed versions 2.8.17-8fakesync12.8.17-9fakesync12.8.17-10ubuntu2 |
None known |
sqlite3Ubuntu:Pro:14.04:LTS |
All versions, plus listed versions 3.7.17-1ubuntu13.8.0.2-1ubuntu13.8.1-1ubuntu13.8.1-1ubuntu33.8.2-1ubuntu1 Show 8 moreShow less3.8.2-1ubuntu23.8.2-1ubuntu2.13.8.2-1ubuntu2.23.8.2-1ubuntu2.2+esm13.8.2-1ubuntu2.2+esm23.8.2-1ubuntu2.2+esm33.8.2-1ubuntu2.2+esm43.8.2-1ubuntu2.2+esm5 |
None known |
sqlite3Ubuntu:Pro:16.04:LTS |
All versions, plus listed versions 3.8.11.1-13.9.1-23.9.2-13.10.0-13.10.1-1 Show 10 moreShow less3.10.2-13.11.0-1ubuntu13.11.0-1ubuntu1.13.11.0-1ubuntu1.23.11.0-1ubuntu1.33.11.0-1ubuntu1.43.11.0-1ubuntu1.53.11.0-1ubuntu1.5+esm13.11.0-1ubuntu1.5+esm23.11.0-1ubuntu1.5+esm3 |
None known |
sqliteUbuntu:16.04:LTS |
All versions, plus listed versions 2.8.17-12fakesync1 |
None known |
sqlite3Ubuntu:Pro:18.04:LTS |
All versions, plus listed versions 3.19.3-33.20.1-23.21.0-13.22.0-13.22.0-1ubuntu0.1 Show 9 moreShow less3.22.0-1ubuntu0.23.22.0-1ubuntu0.33.22.0-1ubuntu0.43.22.0-1ubuntu0.53.22.0-1ubuntu0.63.22.0-1ubuntu0.73.22.0-1ubuntu0.7+esm13.22.0-1ubuntu0.7+esm23.22.0-1ubuntu0.7+esm3 |
None known |
sqliteUbuntu:18.04:LTS |
All versions, plus listed versions 2.8.17-14fakesync1 |
None known |
Show 7 moreShow less
| Package | Affected | Fixed |
|---|---|---|
sqlite3Ubuntu:Pro:20.04:LTS |
All versions, plus listed versions 3.29.0-23.30.1-13.30.1-1ubuntu13.31.1-1ubuntu13.31.1-3 Show 10 moreShow less3.31.1-43.31.1-4ubuntu0.13.31.1-4ubuntu0.23.31.1-4ubuntu0.33.31.1-4ubuntu0.43.31.1-4ubuntu0.53.31.1-4ubuntu0.63.31.1-4ubuntu0.73.31.1-4ubuntu0.7+esm13.31.1-4ubuntu0.7+esm2 |
None known |
sqliteUbuntu:20.04:LTS |
All versions, plus listed versions 2.8.17-15fakesync1build1 |
None known |
sqliteUbuntu:22.04:LTS |
All versions, plus listed versions 2.8.17-15fakesync1build1 |
None known |
sqlite3Ubuntu:22.04:LTS |
All versions, plus listed versions 3.35.5-13.36.0-23.37.2-23.37.2-2ubuntu0.13.37.2-2ubuntu0.3 Show 5 moreShow less3.37.2-2ubuntu0.43.37.2-2ubuntu0.53.37.2-2ubuntu0.63.37.2-2ubuntu0.73.37.2-2ubuntu0.8 |
None known |
sqlite3Ubuntu:24.04:LTS |
All versions, plus listed versions 3.42.0-13.44.0-13.44.2-13.45.0-13.45.1-1 Show 10 moreShow less3.45.1-1ubuntu13.45.1-1ubuntu23.45.1-1ubuntu2.13.45.1-1ubuntu2.33.45.1-1ubuntu2.43.45.1-1ubuntu2.53.45.1-1ubuntu2.63.45.1-1ubuntu2.73.45.1-1ubuntu2.83.45.1-1ubuntu2.9 |
None known |
sqlite3Ubuntu:26.10 |
All versions, plus listed versions 3.46.1-93.53.4-2 |
None known |
sqlite3Ubuntu:26.04:LTS |
All versions, plus listed versions 3.46.1-83.46.1-93.46.1-9ubuntu0.13.46.1-9ubuntu0.23.46.1-9ubuntu0.3 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | CVE List, EUVD, NVD, OSV | |
| affected | OSV | |
| affected | OSV | |
| affected, aliases, references | OSV | |
| facts, references | NVD | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-119377 is a low vulnerability (CVSS 2.0) in Sqlite, published October 30, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.13%, the 2nd percentile. No source names a fixed version.
References
sqlite.org/bugs/info/2026-07-05T08:15:45Z
github.com/sqlite/sqlite/commit/7ff247c5b9ead3ad8a69c26d3fd264878e127237
Show 11 moreShow less
abraxaslabs.tech/research/sqlite-fj-using-auth
vulncheck.com/advisories/sqlite-before-3.54.0-authorizer-bypass-via-right-or-full-join-using
nvd.nist.gov/vuln/detail/CVE-2026-119377
security-tracker.debian.org/tracker/CVE-2026-119377
ubuntu.com/security/CVE-2026-119377
cve.org/CVERecord?id=CVE-2026-119377