CVE-2026-104947: WarehousePG 7.2.1 to before 7.6.1

Affected technology

WarehousePG · 7.2.1 to before 7.6.1
EnterpriseDB

Description’s affected range: through 7.6.0 is affected by a missing authorization vulnerability (CWE-862) in the built-in function gp_log_backend_memory_contexts()

Component: Not specified by the source
Function: gp_log_backend_memory_contexts, without

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

A low-privileged user can force the segment backends of any other session, superuser sessions included, to write their memory context details to the segment server logs, which the attacker cannot read. Source advisory’s CVSS 4.0 assessment (base score 5.3/10) rates confidentiality and integrity impact as none; availability impact as low.