CVE-2026-104947

WarehousePG (WHPG) 7.2.1 through 7.6.0 is affected by a missing authorization vulnerability (CWE-862) in the built-in function gp_log_backend_memory_contexts(). Any authenticated database role can run this function without a GRANT. It also gets around the superuser restriction that PostgreSQL places on the underlying pg_log_backend_memory_contexts() function. A low-privileged user can force the segment backends of any other session, superuser sessions included, to write their memory context details to the segment server logs, which the attacker cannot read. Those details can include query text from other users' cached plans, and the call can be repeated to generate large amounts of log output. WarehousePG 6.x is not affected.

• CWE-862

• https://www.enterprisedb.com/docs/security/advisories/cve2026104947/

Published

Oct 21, 2026

Last Modified

Oct 30, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-104932The Search Regex plugin for WordPress is vulnerable to PHP O…8
• CVE-2026-104935Authentication bypass by spoofing in ICS before version 25.1…8.6
• CVE-2026-104937Shopware version 6.7 allows the upload of attacker‑controlle…8.1
• CVE-2026-104939Description NGINX Ingress Controller has a vulnerability whe…7.5
• CVE-2026-104944TP-Link Tapo C500 v2.0 contains an out-of-bounds function-po…7.1
• CVE-2026-104945TP-Link Tapo C500 v2.0 contains an out-of-bounds stack write…6.8
• CVE-2026-104948WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7…7.1
• CVE-2026-104949WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7…5.4
• CVE-2026-104953The MPG WordPress plugin before 4.2.3 does not properly val…6.8
• CVE-2026-104955Plane is an open-source project management tool. Prior to 1.…5.4
• CVE-2026-104956Plane is an open-source project management tool. Prior to 1.…5.3
• CVE-2026-104960Plane is an open-source project management tool. Prior to 1.…6.5