Unauthorized row access via incorrect user ID reset

Incorrect privilege assignment in PostgreSQL lets remote authenticated users read or change unintended rows in affected releases. The session identity code can restore the wrong effective user ID after SET ROLE or SET SESSION AUTHORIZATION, while parallel workers can expose an incorrect current role. Exploitation requires an application that uses an identity-changing feature and either accepts attacker-controlled query parameters or returns affected query results; the attacker cannot choose the substituted identity.