E-Maj 5.0.1 closes a PostgreSQL superuser escalation path for extension administrators

E-Maj 5.0.1, dated October 28, 2026 in the project's changelog and listed as stable on PGXN on October 29, fixes a vulnerability allowing a PostgreSQL role with emaj_adm privileges to acquire superuser rights. The maintainer says the fix changes ownership of the emaj schema and all its contents to the emaj_adm role. The release also corrects error handling in the emajParallelRollback.pl client when PREPARE TRANSACTION fails. E-Maj provides trigger-based logging and rollback of changes to selected PostgreSQL tables and supports PostgreSQL 14–19 in its 5.0 line.

PostgreSQL superuser rights bypass ordinary database permission boundaries. An extension administrator is often entrusted with audit and rollback functions, but should not thereby gain control of the whole database cluster. The E-Maj flaw is consequential precisely because it crosses that role boundary. The affected audience is narrow: operators who have installed E-Maj and granted emaj_adm privileges, especially in multi-user or delegated administration environments. The public changelog gives the prerequisite and remediation but does not document exploitation in the wild or a complete version-by-version exposure matrix.

The official 5.0.1 change log states that a role holding emaj_adm privileges could obtain PostgreSQL superuser rights. That is not an unauthenticated internet-wide flaw: the role must already possess extension administration privileges. Nonetheless, those privileges can be delegated to people or service accounts that should not control the PostgreSQL cluster. The patch makes the emaj schema and its contents owned by emaj_adm, addressing the unsafe ownership boundary described by the maintainer.

E-Maj records INSERT, UPDATE, DELETE and related table changes with triggers, allowing operators to inspect, replay or roll back groups of tables to marked states. It is used in testing and in production batch or recovery workflows. The 5.0 release added PostgreSQL 19 support and non-superuser installation options, increasing the importance of checking who holds administrative privileges; the sources do not establish exactly when the escalation flaw first appeared.

Operators should identify E-Maj installations, confirm the extension version and review memberships or grants involving emaj_adm. Plan the 5.0.1 upgrade using the project's supported extension installation and upgrade documentation, test rollback operations and check schema ownership afterwards. Avoid assuming that revoking an ordinary application role fixes the extension itself. The parallel rollback error-handling change is operationally useful but separate from the privilege escalation.