The vulnerability is a missing authorization check in the gp_add_coordinator_standby() (or gp_add_master_standby() in earlier releases) function of EnterpriseDB WarehousePG. A non‑superuser who can establish a utility‑mode connection can invoke this routine to insert a fake standby coordinator record into the gp_segment_configuration table. The attacker does not alter or expose existing data, but the fake entry blocks administrators from adding a legitimate standby until they manually delete the bogus entry. The impact is therefore a denial of service to standby configuration rather than data compromise.

EnterpriseDB WarehousePG versions 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected. These include the gp_add_master_standby()/gp_add_coordinator_standby() interface in the WarehousePG 6 and 7 code branches respectively.

The CVSS score for the vulnerability is 2.3, indicating low severity. EPSS information is not available and the issue is not listed in CISA’s KEV catalog, suggesting a relatively low likelihood of widespread exploitation. The vulnerability requires the attacker to obtain a utility-mode connection, which is typically restricted to trusted users or internal networks; thus, the attack vector is likely local or within a maliciously compromised environment rather than from the open internet.