WS-2024-0013

A logical flaw in the pgcron extension allows low-privileged users with ownership over pgcron's job table or ability to change the value of cron.databasename to run arbitrary SQL queries as any user including superusers. This is also possible if superuser jobs are explicitly disabled. An attacker...