RLS bypass: ON CONFLICT DO UPDATE/SELECT evaluates WHERE before RLS check

Edit
ID 7403
Title RLS bypass: ON CONFLICT DO UPDATE/SELECT evaluates WHERE before RLS check
CI (CFBot) Summary
Stats (from CFBot) Patch count: 1, First patch: +44−14, All patches: +44−14
Tags Security
Created 2026-10-06 18:59:16
Last modified 2026-10-06 18:59:34 (48 minutes ago)
Latest email 2026-10-06 18:53:14 (54 minutes ago)
Status
PG20-3 (2026-11-01 – 2026-11-30): Needs review
Target version
Authors Joao Detomini (joaodetomini)
Reviewers Become reviewer
Committer
Links
Emails
RLS bypass: ON CONFLICT DO UPDATE/SELECT evaluates WHERE before RLS check
First at 2026-10-06 18:53:14 by Joao Detomini <joao.detomini at enterprisedb.com>
Latest at 2026-10-06 18:53:14 by Joao Detomini <joao.detomini at enterprisedb.com>
Latest attachment (0001-Check-RLS-policies-before-evaluating-the-ON-CONFLICT.patch) at 2026-10-06 18:53:14 from Joao Detomini <joao.detomini at enterprisedb.com>
    Attachment (0001-Check-RLS-policies-before-evaluating-the-ON-CONFLICT.patch) at 2026-10-06 18:53:14 from Joao Detomini <joao.detomini at enterprisedb.com> (Patch: No)
History
When Who What
2026-10-06 18:59:34 Joao Detomini (joaodetomini) Changed name to RLS bypass: ON CONFLICT DO UPDATE/SELECT evaluates WHERE before RLS check
2026-10-06 18:59:16 Joao Detomini (joaodetomini) Attached mail thread CABH8dKzYzRKD4izbushndHvvsEQg9b6m3w9ncYAGMbZ5m+9gNg@mail.gmail.com
2026-10-06 18:59:16 Joao Detomini (joaodetomini) Created patch record
Edit