WarehousePG’s built‑in cluster expansion functions gp_expand_lock_catalog() and gp_expand_bump_version() lack privilege checks, allowing any authenticated role to execute them. The first function can be invoked inside a transaction to lock the catalog for all users, preventing all catalog changes—including DDL, temporary table creation, GRANT and CREATE ROLE—across the cluster until the transaction ends. The second function, when called repeatedly, disconnects sessions that hold temporary tables, producing a fatal error on their next catalog change, and forces other sessions to rebuild segment connections. Together, these effects can bring the database cluster to a state where ordinary operations cannot proceed, effectively causing a denial of service for all users, even superusers, until the offending session is terminated. The underlying weakness is an unauthorized privilege escalation (CWE-862).

EnterpriseDB WarehousePG versions 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected; any authenticated database role can run the vulnerable functions.

The CVSS score of 7.1 indicates a moderate‑to‑high severity. Because the flaw does not require network exposure and can be triggered by any authenticated role, the likely attack vector is local database access. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, suggesting that while exploitation is straightforward, there may be limited evidence of active attacks. An attacker with basic database permissions can strategically block cluster‑wide catalog operations, causing service outages and persistent disruption until the offending session is terminated.