diff --git a/doc/src/sgml/release-12.sgml b/doc/src/sgml/release-12.sgml
index 02cee2e6534..6ca12bc88a2 100644
--- a/doc/src/sgml/release-12.sgml
+++ b/doc/src/sgml/release-12.sgml
@@ -47,6 +47,50 @@
+
+ Tighten security restrictions within REFRESH MATERIALIZED
+ VIEW CONCURRENTLY (Heikki Linnakangas)
+
+
+
+ One step of a concurrent refresh command was run under weak security
+ restrictions. If a materialized view's owner could persuade a
+ superuser or other high-privileged user to perform a concurrent
+ refresh on that view, the view's owner could control code executed
+ with the privileges of the user running REFRESH.
+ Fix things so that all user-determined code is run as the view's
+ owner, as expected.
+
+
+
+ The only known exploit for this error does not work
+ in PostgreSQL 16.0 and later, so it may
+ be that v16 is not vulnerable in practice.
+
+
+
+ The PostgreSQL Project thanks Pedro
+ Gallegos for reporting this problem.
+ (CVE-2024-0985)
+
+
+
+
+