Skip to main content

Missing Authorization

CVE-2025-12817

Low
3.1/10

Summary

Missing authorization in PostgreSQL CREATE STATISTICS command allows a table owner to achieve Denial-of-Service (DoS) against other CREATE STATISTICS users by creating in any schema. A later CREATE STATISTICS for the same name, from a user having the CREATE privilege, would then fail. This affects PostgreSQL versions through 13.22, 14.x through 14.19, 15.x through 15.14, 16.x through 16.10, 17.x through 17.6, and 18.x through 18.0.

  • HIGH
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • LOW
  • NONE
  • LOW

CWE-862 - Missing Authorization

The missing authorization vulnerability occurs when a software program allows users to access privileged parts of the program without verifying the user credentials. Impact of such a vulnerability depends on the resources employed by the software, ranging from account takeover to sensitive information exposure, denial of service, and complete system takeover.

References

Advisory Timeline

  • Published