PostgreSQL Anonymizer CVE-2026-105619

Exploitation requires that data be accessed through a PostgreSQL view created with the security_invoker option (a view that runs with the querying user's privileges rather than the view owner's); when a masked role reads through such a view, PostgreSQL Anonymizer fails to apply its masking rules and returns unmasked values. Limiting factors: the attacker must be an authenticated database user subject to masking (PR:L), a security_invoker view over the protected data must exist, and the affected version must be earlier than 3.3.0. These conditions mean the risk is primarily exposure of sensitive data to already-authenticated low-privilege roles rather than remote unauthenticated access; the exact trigger steps are not detailed in the available sources.

Signals are moderate and internally consistent rather than alarming. The CVSS 3.1 base score is 4.8 (Medium) with vector AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N - high confidentiality impact but gated behind an authenticated low-privileged account (PR:L), high attack complexity (AC:H) and required user interaction (UI:R). No EPSS probability and no KEV status were supplied, and CISA has not listed this; the vuln.today decision label is 'this_month', i.e. patch on a routine monthly cycle, not an emergency. There is no SSVC breakdown in the input. The single reference is the vendor's GitLab issue tracker (issue 697), which is an advisory/report, not verified exploit code, so there is no public exploit identified at time of analysis. Note a signal conflict worth flagging: the Tags call this 'Authentication Bypass', but CWE-862 (Missing Authorization) and the description (masked data is exposed to a role that should only see masked values) make this an authorization/data-masking bypass, not authentication - treat it as an access-control exposure. Net: a real but bounded issue. The exposure is of sensitive data to database users who already have authenticated, low-privilege access and can reach a security_invoker view, i.e. closer to insider/authorized-user data leakage than remote mass exploitation. Prioritize patching but it is not a high-urgency internet-facing emergency.

A low-privileged PostgreSQL role that is supposed to see only anonymized output queries sensitive columns through a view defined with the security_invoker option and receives the original, unmasked values instead of the masked ones. This defeats the intended data-masking guarantee for that role. No public exploit code is available; the issue is documented only in the vendor's GitLab issue tracker.