{"id":"AZL-111781","summary":"CVE-2026-119377 affecting package sqlite 3.44.0-4","details":"SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only for the first joined table's USING column. Attackers able to submit SQL can query a shared USING column in a RIGHT or FULL JOIN to read columns denied via sqlite3_set_authorizer() SQLITE_READ restrictions.","modified":"2026-10-31T14:17:40.513209609Z","published":"2026-10-30T12:16:36Z","upstream":["CVE-2026-119377"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119377"}],"affected":[{"package":{"name":"sqlite","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/sqlite"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.44.0-4"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-111781.json"}}],"schema_version":"1.9.2"}