Postgres: Abusing Security Definer Functions

But even if the code is well-written, there is a danger: unqualified access to database objects from the function (that is, accessing objects without explicitly specifying the schema) can affect other objects than the author of the function intended. The attack depends on two things:

The malicious database user “ ” can simply run the following code:

The function executed with superuser permissions. But since the statement inside the function ran with superuser permissions, so did the operator function.

Source: www.cybertec-postgresql.com