{"schema":"threatline.record/2","record":{"id":"CVE-2026-104948","aliases":[],"summary":"WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authorization vulnerability (CWE-862) in the built-in cluster expansion functions gp_expand_lock_catalog() an","details":"WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authorization vulnerability (CWE-862) in the built-in cluster expansion functions gp_expand_lock_catalog() and gp_expand_bump_version(). Any authenticated database role can run them, and neither checks privileges. A low-privileged user can call gp_expand_lock_catalog() inside an open transaction to block all catalog changes across the cluster for every user, superusers included, until that transaction ends, which in practice requires a superuser to terminate the session. Blocked changes include DDL, temporary table creation, GRANT and CREATE ROLE. The same user can call gp_expand_bump_version() repeatedly. Each call disconnects sessions that hold temporary tables, with a FATAL error on their next catalog change, and makes every other session rebuild its segment connections.","categories":["Unclassified"],"product":"WarehousePG","vendor":"EnterpriseDB","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-104948","source_modified_at":"2026-10-21T13:53:54.574Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"WarehousePG","vendor":"EnterpriseDB","versions":[{"version":"6.27.1","status":"affected","lessThan":"6.27.7","versionType":"semver"},{"version":"7.2.1","status":"affected","lessThan":"7.6.1","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-104948","source_modified_at":"2026-10-21T13:53:54.574Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WarehousePG","ecosystem":null},"version":"6.27.7","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-104948","source_modified_at":"2026-10-21T13:53:54.574Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WarehousePG","ecosystem":null},"version":"7.6.1","basis":"first unaffected version stated in the CVE record"}],"cvss":7.1,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00216,"percentile":0.11449,"score_date":"2026-10-23"},"published_at":"2026-10-21T13:53:54.574Z","modified_at":"2026-10-21T13:53:54.574Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-104948","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-21T13:53:54.574Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-104948","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://www.enterprisedb.com/docs/security/advisories/cve2026104948/"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-21T13:53:54.574Z","content_hash":"2efcc683c3047651648a9efa0936db869bd117b079f84c8f9338a6589d1c04fb"}}