CVE-2026-119377

Description

SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only for the first joined table's USING column. Attackers able to submit SQL can query a shared USING column in a RIGHT or FULL JOIN to read columns denied via sqlite3_set_authorizer() SQLITE_READ restrictions.

References

https://www.vulncheck.com/advisories/sqlite-before-3.54.0-authorizer-bypass-via-right-or-full-join-using

https://sqlite.org/src/info/bbd69ce274620008

https://sqlite.org/src/info/2cb22877683680c1

https://sqlite.org/releaselog/3_54_0.html

https://sqlite.org/bugs/info/2026-07-05T08:15:45Z

https://github.com/sqlite/sqlite/commit/7ff247c5b9ead3ad8a69c26d3fd264878e127237

https://github.com/sqlite/sqlite/commit/5694c3bb2a6a40770ecd2f65910eea756734dfd8

https://github.com/sqlite/sqlite/blob/version-3.53.4/src/resolve.c#L775

https://github.com/sqlite/sqlite

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-113788

https://abraxaslabs.tech/research/sqlite-fj-using-auth

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

CVSS v4

EPSS