Is CVE-2026-119377 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-119377?

CVE-2026-119377 has a CVSS v3 severity of LOW (2.5).

Back

CVE-2026-119377

Description

SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only for the first joined table's USING column. Attackers able to submit SQL can query a shared USING column in a RIGHT or FULL JOIN to read columns denied via sqlite3_set_authorizer() SQLITE_READ restrictions.