CVE-2026-119377

Description

SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only for the first joined table's USING column. Attackers able to submit SQL can query a shared USING column in a RIGHT or FULL JOIN to read columns denied via sqlite3_set_authorizer() SQLITE_READ restrictions.

Affected Platforms

Weakness Type

CWE-863

References

• https://abraxaslabs.tech/research/sqlite-fj-using-auth
• https://github.com/sqlite/sqlite
• https://github.com/sqlite/sqlite/blob/version-3.53.4/src/resolve.c#L775
• https://github.com/sqlite/sqlite/commit/5694c3bb2a6a40770ecd2f65910eea756734dfd8
• https://github.com/sqlite/sqlite/commit/7ff247c5b9ead3ad8a69c26d3fd264878e127237
• https://sqlite.org/bugs/info/2026-07-05T08:15:45Z