The PostgreSQL ALTER TABLE … ALTER TYPE command incorrectly assigns ownership of the associated statistics objects to the user executing the command. As a result, a table owner can drop or alter statistics that they should not control, while the original owner loses permission. In most cases the attacker cannot affect table data because DROP TABLE can still remove the statistics. The vulnerability involves improper internal state control, identified as CWE‑708.

This issue affects PostgreSQL releases prior to version 18.6, 17.11, 16.15, 15.19, and 14.24. All installations using these versions are at risk if ALTER TABLE ALTER TYPE is used to modify a table whose statistics objects would be affected. The vulnerability is vendor‑specific to PostgreSQL and its statistics system.

The CVSS score is 3.8, reflecting a low severity. Because the EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, the likelihood of active exploitation is currently low. The exploit requires a user with ALTER TABLE privileges, and the best‑case damage is limited to deletion or modification of statistics metadata; it does not affect table data or schema directly. Nevertheless, the misownership may leak permissions or impact query planning accuracy, so it should be addressed promptly.