CVE-2026-120065

A flaw was found in postgresql-odbc. When handling updatable cursors, the driver fails to properly sanitize quotation marks in column names before inserting them into internal database queries. An authenticated database user with permission to create tables, or an untrusted database server, can exploit this flaw by specifying crafted column names. This enables an attacker to manipulate SQL queries executed with the application's privileges, potentially resulting in unauthorized data modification, deletion, or information disclosure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.