Check CREATE privilege on multirange type schema in CREATE TYPE.
Nathan Bossart <nathan@postgresql.org>
Author:
Nathan Bossart <nathan@postgresql.org>
Committer:
Noah Misch <noah@leadboat.com>
Date: 2026-05-11T12:13:47Z
Releases:
19 (unreleased)
Check CREATE privilege on multirange type schema in CREATE TYPE. This omission allowed roles to create multirange types in any schema, potentially leading to privilege escalations. Note that when a multirange type name is not specified in CREATE TYPE, it is automatically placed in the range type's schema, which is checked at the beginning of DefineRange(). Reported-by: Jelte Fennema-Nio <postgres@jeltef.nl> Author: Jelte Fennema-Nio <postgres@jeltef.nl> Reviewed-by: Nathan Bossart <nathandbossart@gmail.com> Reviewed-by: Tomas Vondra <tomas@vondra.me> Security: CVE-2026-6472 Backpatch-through: 14
Files
| Path | Change | +/− |
|---|---|---|
| src/backend/commands/typecmds.c | modified | +7 −0 |
| src/test/regress/expected/multirangetypes.out | modified | +16 −0 |
| src/test/regress/sql/multirangetypes.sql | modified | +16 −0 |