A flaw in pglogical causes replica changes to trigger default expressions on the subscriber when a row is missing columns. The apply worker operates at superuser privilege on the subscriber, so any function called by the default expression also runs as superuser. An attacker who can control the publisher can exploit this to execute arbitrary functions on the subscriber with full superuser rights, effectively escalating from a pglogical‑permitted role to a superuser. This is a classic privilege‑escalation issue (CWE‑250).

The vulnerability affects EnterpriseDB pglogical. It is relevant to deployments where non‑superuser roles are granted permission to create subscriptions, which is typical in managed database services. No specific affected versions are listed.

The CVSS score of 9 indicates high severity, yet the EPSS score is less than 1%, reflecting a low likelihood of exploitation in the wild. The issue is not listed in the CISA KEV catalog. Exploitation requires the attacker to act as the publisher and create a subscription pointing to an endpoint they control. In default installations, this requires superuser privileges to create subscriptions, so the risk is highest in managed setups that delegate subscription creation to lower‑privileged roles. The attack vector is therefore limited to scenarios where a non‑superuser can publish to a subscriber they govern.