PostgreSQL Anonymizer 2.5 contains a missing search_path protection that allows an ordinary database user to create a malicious custom operator in the public schema. When the extension is later created, the operator is executed with superuser privileges, enabling the attacker to gain full administrative control over the PostgreSQL instance. This flaw is a classic privilege‑escalation vulnerability and is classified as CWE‑427.

The vulnerability impacts the Dalibo PostgreSQL Anonymizer extension version 2.5 running on PostgreSQL 14 databases, and on any PostgreSQL instance that has been upgraded from 14 where the public schema still grants CREATE rights to PUBLIC. PostgreSQL 15 and later are not affected by default, because CREATE is revoked on the public schema, but the exploit could still succeed if a superuser creates another schema on the search_path and grants CREATE to untrusted users – a configuration that is strongly discouraged.

The CVSS score is 8.0, indicating high severity. The EPSS score is less than 1%, so the likelihood of exploitation is considered very low, and the vulnerability is not in the CISA KEV catalog. The attack vector is inferred to be an authenticated database user that has permission to create operators in the public schema, which is common in a default PostgreSQL installation where PUBLIC has CREATE rights. Once the malicious operator is triggered during extension creation, it executes with superuser privileges, allowing the attacker to read, modify, or delete any data and execute arbitrary SQL commands.