pg_authid Privilege Flag Change Without Matching ALTER ROLE

Arnold Chan@slaz

•updated Sep 5, 2026•0•0•1

Detects direct SQL UPDATE operations on the pg_authid system table to modify privilege flags (e.g., rolsuper, rolcreaterole) without using the authorized ALTER ROLE statement. Such activity often indicates an attempt to escalate privileges or modify database user permissions in an unauthorized manner, bypassing standard auditing and role management processes.