PostgreSQL Anonymizer includes an unbounded anon.hash function that any masked user can invoke repeatedly. By collecting the seed and hash output for each call, an attacker can mount an offline brute‑force search to recover the secret salt, and then invert the hashing to recover unmasked data. This vulnerability allows a non‑privileged user to compromise data confidentiality.

The issue affects all deployed Dalibo PostgreSQL Anonymizer releases earlier than version 3.1.2. The vulnerability is fixed in 3.1.2 and later.

The CVSS v3.1 score of 4.3 denotes moderate risk, and without an EPSS score the exploitation likelihood remains unclear. The vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation. An attacker would need direct database query access under a masked user role, and repeated calls to the hash function, which may be detectable via logs. The potential for data deanonymization exists only if the attacker can perform the time‑consuming offline search.