postgresql-server -- non-owner REFRESH MATERIALIZED VIEW CONCURRENTLY executes arbitrary SQL

PostgreSQL Project reports:

    One step of a concurrent refresh command was run under
    weak security restrictions. If a materialized view's
    owner could persuade a superuser or other
    high-privileged user to perform a concurrent refresh on
    that view, the view's owner could control code executed
    with the privileges of the user running REFRESH. The fix
    for the vulnerability makes is so that all
    user-determined code is run as the view's owner, as
    expected.