CVE-2020-25695: PostgreSQL privilege escalation via object creation in schema

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityCVSS 8.8 with high confidentiality, integrity and availability impact and a very high EPSS percentile, though exploitation requires an authenticated account with schema creation rights.

What it is

PostgreSQL before 13.1, 12.5, 11.10, 10.15, 9.6.20 and 9.5.24 allows a user with permission to create non-temporary objects in at least one schema to execute arbitrary SQL functions as a superuser. This is a privilege escalation that undermines the database's role separation and exposes all data and functions the superuser can reach.

Impact

An attacker with a low-privileged database account gains superuser-level execution, compromising confidentiality, integrity and availability of the entire database instance.

Attack surface

Reachable over the network via normal database connections (CVSS AV:N) by an authenticated user holding CREATE rights on any schema; no user interaction is required.

Exploitation

Not listed in CISA KEV and no public exploit references are tagged in the record, but EPSS is 0.4644 (98.8th percentile), indicating elevated predicted exploitation activity.

What to do

• Upgrade PostgreSQL to 13.1, 12.5, 11.10, 10.15, 9.6.20, 9.5.24 or later as applicable.
• Audit and revoke CREATE privileges on schemas from roles that do not require them.
• Apply the vendor and distribution advisories (Debian, Gentoo, NetApp) for packaged deployments.
• Restrict database network exposure and enforce least-privilege role design.
• Monitor for unexpected creation of functions or objects in schemas by non-administrative roles.

Detection

• Alert on CREATE FUNCTION or CREATE object events in schemas by roles that normally lack such rights.
• Review PostgreSQL logs for privilege changes or superuser-context execution originating from low-privileged sessions.
• Baseline schema object inventories and flag new non-temporary objects in unexpected schemas.
• Correlate database audit logs with authentication events for unusual role-to-superuser activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.