Incorrect privilege assignment in PostgreSQL allows a
less-privileged application user to view or change
different rows from those intended. An attack requires
the application to use SET ROLE, SET SESSION
AUTHORIZATION, or an equivalent feature. The problem
arises when an application query uses parameters from
the attacker or conveys query results to the attacker.
If that query reacts to current_setting('role') or the
current user ID, it may modify or return data as though
the session had not used SET ROLE or SET SESSION
AUTHORIZATION. The attacker does not control which
incorrect user ID applies. Query text from
less-privileged sources is not a concern here, because
SET ROLE and SET SESSION AUTHORIZATION are not sandboxes
for unvetted queries