Vulnerability in SQLite

[ Description ]Official description

SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only for the first joined table's USING column. Attackers able to submit SQL can query a shared USING column in a RIGHT or FULL JOIN to read columns denied via sqlite3_set_authorizer() SQLITE_READ restrictions.

[ Fixes ]Fixes and patches

• Patch on github.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
• Patch on github.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD

[ Advisories ]Government CERT advisories

• BSI CERT-Bund1 Nov 2026WID-SEC-2026-4260

  SQLite: Multiple vulnerabilities Translated from German

  CVE-2026-119375CVE-2026-119373CVE-2026-119379+8 more CVEs

[ References ]References

• abraxaslabs.tech/research/sqlite-fj-using-authExploitThird Party Advisory
• github.com/sqlite/sqliteProduct
• github.com/sqlite/sqlite/blob/version-3.53.4/src/resolve.cProduct
• github.com/sqlite/sqlite/commit/5694c3bb2a6a40770ecd2f65910eea756734dfd8Patch
• github.com/sqlite/sqlite/commit/7ff247c5b9ead3ad8a69c26d3fd264878e127237Patch
• sqlite.org/bugs/info/2026-07-05T08:15:45ZIssue TrackingVendor Advisory
• sqlite.org/releaselog/3_54_0.htmlRelease Notes
• sqlite.org/src/info/2cb22877683680c1Issue Tracking
• sqlite.org/src/info/bbd69ce274620008Issue Tracking
• www.vulncheck.com/advisories/sqlite-before-3.54.0-authorizer-bypass-via-right-or-full-j…Third Party Advisory