PostgreSQL Anonymizer EUVD-2026-112295

Exploitation requires that the target database actually uses the anon.partial() or anon.partial_email() masking functions on a column, AND that the underlying value is small enough that partial masking leaves the data effectively unredacted - both the feature use and short data are prerequisites named in the description. The attacker must also be an authenticated user (CVSS PR:L) with query access to the masked column. Limiting factors: deployments that do not use these two specific partial-masking functions are unaffected; values large enough to be meaningfully masked are not disclosed; and the attacker cannot reach the data without existing authenticated database access. The precise size threshold that triggers disclosure is not described in the available sources.

This is a moderate, authenticated information-disclosure flaw (CWE-693, Protection Mechanism Failure) rather than a high-urgency issue. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3) indicates a network-reachable but authenticated attacker (PR:L) gaining only limited confidentiality impact (C:L) with no integrity or availability effect - consistent with a masking function that leaks original values rather than a system compromise. There is no CISA KEV listing and no EPSS score provided in the input, and the single reference is a Dalibo GitLab issue tracker entry, not verified working exploit code, so there is no public exploit identified at time of analysis. The vuln.today decision label is 'this_month', which aligns with the low CVSS and absence of exploitation signals - this is a patch-in-routine-cycle issue, not an emergency. The main caveat: the signal set is thin (no EPSS, no SSVC vector, no vendor advisory beyond the issue link), so the assessment rests mainly on the CVSS vector and the terse description.

An authenticated low-privilege PostgreSQL user who is only supposed to see masked output queries a column protected by anon.partial() or anon.partial_email(); because the value is short enough, the masking leaves little or nothing redacted and the original sensitive data (e.g. a short name or email local-part) is returned in cleartext. No public exploit code is identified, and exploitation requires existing authenticated access to the masked data per the CVSS vector (PR:L).