SQLite versions prior to 3.54.0 allow an attacker to bypass authorization limits set by sqlite3_set_authorizer() for read operations. The vulnerability originates in the lookupName() routine, which triggers the authorizer only for the first table in a RIGHT or FULL JOIN that uses a shared column in the USING clause. As a result, an attacker who can supply arbitrary SQL can read columns that should otherwise be denied by SQLITE_READ restrictions, exposing sensitive data. The weakness corresponds to CWE‑863 and presents a confidentiality risk when the attacker has execution or injection access to the SQLite instance.

All installations of SQLite 3.53.x and earlier, including the native SQLite binaries bundled with applications that rely on those versions. The vulnerability is specifically tied to the SQLite library, version 3.53.4 and earlier, until the 3.54.0 release unconditionally fixes the authorizer invocation logic.

The CVSS score of 2 indicates a low severity rating under the standard metric set, and the EPSS score is not available, suggesting no empirical data on exploitation frequency. However, the vulnerability exists in widely deployed embedded databases and can be triggered through crafted SQL input, making it actionable for attackers who can inject queries. The permissive exploit path via a crafted RIGHT or FULL JOIN means capability is sufficient for a read‑only data leak. The vulnerability is not listed in the CISA KEV catalog, implying no known, widespread, or actively weaponized exploits at the time of analysis.