CVE-2026-65314
Electric Postgres Sync Excluded-Column Value Inference via Subset Where Clauses
- State
- Published
- Severity
- 5.3 Medium
- Published
- Jul 21, 2026
- Updated
- Sep 24, 2026
- Reserved
- Jul 21, 2026
Description
Electric Postgres Sync versions below 1.6.10 contains an information disclosure vulnerability that allows attackers to infer the values of excluded columns by crafting subset where clause conditions against shape responses. Attackers can observe whether subset where conditions match rows to deduce sensitive field data even though those columns are not returned in shape responses, bypassing column-based access restrictions.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 4.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | VulnCheck |
Weaknesses
- CWE-203 Observable Discrepancy
Affected Products
| Product | Versions |
|---|---|
Electric Postgres SyncElectricSQL |
|
References
- GitHub Security Advisoryvendor-advisory
- Productpatch
- https://www.vulncheck.com/advisories/electric-postgres-sync-excluded-column-value-inference-via-subset-where-clausesthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.