WarehousePG contains a missing authorization flaw that allows any authenticated database role to invoke the gp_log_backend_memory_contexts function without needing GRANT privileges. The function circumvents PostgreSQL's superuser restrictions, causing segment backends of other sessions—including superuser sessions—to write comprehensive memory context details, including cached query text, to server logs. Although the attacker cannot read these logs directly, the ability to repeatedly trigger this function can lead to excessive log output and potential denial of service, and may indirectly expose sensitive queries if logs are accessed by other privileged users.

This vulnerability exists in EnterpriseDB WarehousePG versions 7.2.1 through 7.6.0. Versions from the 6.x line are unaffected. The affected component is the built‑in function gp_log_backend_memory_contexts, which can be executed by any authenticated role due to the missing authorization controls.

The CVSS score of 5.3 indicates moderate severity, and no EPSS score is available, so the likelihood of exploitation is unclear. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an authenticated database role with limited privileges; such a role can run the function directly, circumvent superuser restrictions, and trigger log generation. The impact is limited to potential log flooding and possible indirect information disclosure via logs that may later be read by higher‑privileged users.