CVE-2026-116303

Missing authorization in PostgreSQL type conversion allows a database user to invoke a cast function despite lacking EXECUTE privilege on that function, via foreign keys, tojson, and others. A successful attack requires the attacker to search each database for access-restricted cast functions and...