The vulnerability involves the PostgreSQL ALTER TABLE … command incorrectly assigning ownership of dependent statistics objects to the currently connected user. This misassignment allows the table owner to execute DROP STATISTICS and ALTER STATISTICS on these objects, violating the intended ownership model and potentially leading to unauthorized manipulation of statistical metadata. This is an instance of improper internal state control (CWE‑708).

This issue affects PostgreSQL releases prior to version 18.5, 17.11, 16.15, 15.19, and 14.24. All installations using these versions are at risk if ALTER TABLE ALTER TYPE is used to modify a table whose statistics objects would be affected. The vulnerability is vendor‑specific to PostgreSQL and its statistics system.

The CVSS score is 3.8, reflecting a low severity. Because the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the likelihood of active exploitation is currently low. The exploit requires a user with ALTER TABLE privileges, and the best‑case damage is limited to deletion or modification of statistics metadata; it does not affect table data or schema directly. Nevertheless, the misownership may leak permissions or impact query planning accuracy, so it should be addressed promptly.