E-Maj 5.0.1 patches privilege escalation flaw in PostgreSQL extension

E-Maj, a PostgreSQL extension that provides fine-grained write logging and time travel capabilities for database subsets, has released version 5.0.1 to address a serious security vulnerability. The flaw, present in all previous releases, could enable certain users to escalate their privileges to superuser under specific conditions.

The update maintains compatibility with PostgreSQL versions 14 through 19. The accompanying Emaj_web client at version 5.0 remains compatible with E-Maj extension releases from 3.0 to 5.0. The core extension is distributed through PGXN, with source code and development resources available on GitHub.

Security fix and compatibility scope

• Privilege escalation vulnerability: The release patches a flaw in all prior E-Maj versions that allowed some users to obtain superuser privileges under certain conditions.
• PostgreSQL version support: E-Maj 5.0.1 is compatible with PostgreSQL 14, 15, 16, 17, 18, and 19.
• Emaj_web client compatibility: The Emaj_web 5.0 client works with E-Maj extension versions 3.0 through 5.0, preserving existing deployments.
• Distribution channels: The core extension is available via PGXN for installation; both the extension and web client source are hosted on GitHub for development access.

Why it matters

Database administrators running E-Maj in production environments should prioritize this update due to the superuser privilege escalation risk. The broad PostgreSQL version support ensures most current deployments can patch without upgrading their underlying database engine, reducing operational friction for organizations relying on E-Maj's write logging and rollback capabilities for compliance or disaster recovery workflows.