PostgreSQL Anonymizer CVE-2026-105615

Requires that PostgreSQL Anonymizer be deployed for data masking AND that the attacker already possess a 'masked' database role holding SELECT privilege on the target table. Exploitation works because the table's optimizer statistics (the pg_stats histogram bounds and most-common-value arrays) remain readable to any role with SELECT, regardless of the mask. Limiting factors: the attacker must be an authenticated principal with an assigned masked role (not anonymous/remote-unauthenticated); only a limited subset of values is recoverable (statistical samples, not full rows); and exposure is confined to versions prior to PostgreSQL Anonymizer 3.3.0, which resolves the issue.

This is a low-severity information-disclosure issue (input CVSS 3.5) in PostgreSQL Anonymizer, not a priority emergency. The vuln.today decision label is 'monitor', consistent with the low score. The attack vector is network (AV:N) but the input vector requires low privileges (PR:L) - exploitation presupposes an attacker who already holds a legitimate 'masked' database role with SELECT privilege, so this is a confidentiality-boundary bypass by an authenticated insider rather than a remote unauthenticated breach. Impact is limited (C:L, I:N, A:N): the masked role can infer a limited subset of underlying values through the optimizer's statistics (histograms and most-common-value lists), not read the full table. No EPSS score, no CISA KEV listing, and no verified exploit code were provided; the single reference is a GitLab issue tracker entry, not a weaponized PoC. One conflict to verify: the input vector carries UI:R (user interaction required), which does not fit a query-driven statistics read performed by the attacking role itself - this independent assessment uses UI:N (see assessed vector). Net: a real but low-urgency privacy-weakening flaw whose practical risk is confined to environments relying on PostgreSQL Anonymizer's dynamic/static masking to protect data from roles that still have SELECT on the masked tables.

An analyst assigned a 'masked' role is granted SELECT on a table whose sensitive columns are protected by PostgreSQL Anonymizer masking. Instead of reading the (masked) rows, they query the planner statistics exposed for that table and reconstruct a limited subset of the real values from the stored histogram boundaries and most-common-value lists. No public, verified exploit code was provided; only a GitLab issue reference exists.