E-Maj fixes a possible PostgreSQL privilege escalation
E-Maj 5.0.1 fixes a vulnerability that can let some users gain PostgreSQL superuser privileges under circumstances not detailed in the announcement. E-Maj is an extension for recording writes and returning selected parts of a database to an earlier state. The maintainer says all previous extension versions are affected and urges existing users to update promptly.
E-Maj · PostgreSQL · Oct 31, 2026
Why it matters
An extension’s privileges can undermine database access controls even when the PostgreSQL server itself is current.
More context
The October 31 release supports PostgreSQL 14 through 19. Review the documented extension-update procedure and test it against an existing logging setup before deployment. The announcement links documentation and the extension’s PGXN distribution.
Keep in mind
The short notice does not identify the required attacker privileges or establish a confirmed compromise. This is an E-Maj extension fix, not a PostgreSQL server security release.
Original read