EUVD-2026-46635
GHSA-qm4p-6mgx-rmgj
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible shape API (AV:N), low-complexity iterative probing (AC:L), authenticated access required (PR:L), inference-only confidentiality impact with no integrity or availability effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
Electric Postgres Sync versions below 1.6.10 contains an information disclosure vulnerability that allows attackers to infer the values of excluded columns by crafting subset where clause conditions against shape responses. Attackers can observe whether subset where conditions match rows to deduce sensitive field data even though those columns are not returned in shape responses, bypassing column-based access restrictions.
AnalysisAI
Column-value inference via observable discrepancy in Electric Postgres Sync below 1.6.10 allows authenticated remote attackers to deduce the values of columns intentionally excluded from shape responses. By crafting subset WHERE clause conditions against shape endpoints and observing whether rows are matched or returned, an attacker can systematically enumerate sensitive field data that the application's column-based access restrictions are designed to conceal. No public exploit code or active exploitation has been identified at time of analysis; a vendor patch is available at version 1.6.10.
Technical ContextAI
Electric Postgres Sync (CPE: cpe:2.3:a:electricsql:electric_postgres_sync:*:*:*:*:*:*:*:*) is an open-source real-time data synchronization framework by ElectricSQL that streams PostgreSQL rows to client applications using a 'shapes' abstraction. Shapes allow operators to restrict which columns are exposed to a given client, functioning as a coarse column-level access control mechanism. The root cause is CWE-203 (Observable Discrepancy): the framework's response behavior - specifically, whether a shape matches or returns rows - differs in a way that is correlated with the values of excluded columns when a caller supplies a WHERE predicate. This creates a binary oracle: an attacker submits repeated shape requests with increasingly precise WHERE clause conditions (e.g., range comparisons, equality checks) against the excluded column and observes the matching behavior, enabling a binary-search-style enumeration of the underlying field value without the column ever appearing in a response payload.
RemediationAI
Upgrade Electric Postgres Sync to version 1.6.10 or later, which is the vendor-released patch addressing this vulnerability per the advisory at https://github.com/electric-sql/electric/security/advisories/GHSA-c82q-v86f-c87f. If an immediate upgrade is not possible, a compensating control is to restrict which WHERE clause predicates clients are permitted to supply in shape requests - for example, by applying server-side validation or allowlisting of permissible filter fields so that predicates cannot reference excluded columns. Note that this workaround requires application-layer enforcement and may break legitimate client query patterns. Additionally, auditing whether column exclusion via shapes is being used as a sole access control mechanism is advisable; if so, implementing row-level security at the PostgreSQL layer provides defense-in-depth that is not bypassable through shape request manipulation.
More in PostgreSQL
View allPostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() improperl
An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, and 9.0.x before 9.0.13 allows re
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
Unauthenticated SQL injection in Sangoma Switchvox SMB Edition 8.3 (build 104997) lets remote attackers execute arbitrar
PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allow
The build_tablename function in pgsql.c in the PostgreSQL (aka pgsql) extension in PHP through 5.6.7 does not validate t
A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.4 allows unauthenticated remote attackers to execute arbitra
In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_serve
Unauthenticated SQL injection in Vendure Shop API allows remote attackers to execute arbitrary SQL commands against the
Parse Server is an open source http web server backend. Rated critical severity (CVSS 10.0), this vulnerability is remot
Hard-coded default PostgreSQL credentials shipped in the docker-compose.yaml of langgenius Dify through version 1.5.1 al
Same weakness CWE-203 – Observable Discrepancy
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today