CVE-2026-40906

Electric: SQL Injection via ORDER BY Parameter in Shape API

Published Apr 21, 2026 CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed

Description

Electric is a Postgres sync engine. From 1.1.12 to before 1.5.0, the order_by parameter in the ElectricSQL /v1/shape API is vulnerable to error-based SQL injection, allowing any authenticated user to read, write, and destroy the full contents of the underlying PostgreSQL database through crafted ORDER BY expressions. This vulnerability is fixed in 1.5.0.

Analysis

Technical impact

The vulnerability resides in the order_by parameter of the ElectricSQL /v1/shape API and permits error‑based SQL injection, allowing any authenticated user to execute arbitrary SQL against the underlying PostgreSQL database. This flaw makes it possible to read, modify, and delete all database contents, effectively giving full control over the database. The weakness is a classic SQL injection (CWE‑89).

Affected Systems

Electric PostgreSQL sync engine versions from 1.1.12 up to, but not including, 1.5.0 are affected.

Risk and Exploitability

The CVSS score is 10, reflecting the catastrophic impact. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. Attackers need authenticated access to the /v1/shape endpoint; once authenticated, they can craft ORDER BY expressions to trigger the injection, read or modify any table, and even delete data.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

electric-sql

electric

affected

Version	Status	Constraints
`>= 1.1.12, < 1.5.0`	affected	—

Configuration 1 [-]

cpe:2.3:a:electric:sync-service:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Electric-sql

Electric

Version	Status	Scheme	Platform
`[1.1.12,1.5.0)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Electric to version 1.5.0 or later where the vulnerability is fixed
Restrict authenticated access to the /v1/shape endpoint to the minimum required roles and monitor logs for anomalous ORDER BY expressions
If immediate upgrade is not feasible, temporarily block or remove the ORDER BY parameter from API calls and validate input against a whitelist

Generated by OpenCVE AI on April 22, 2026 at 06:42 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.461% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://access.redhat.com/security/cve/CVE-2026-40906
https://bugzilla.redhat.com/show_bug.cgi?id=2460291
https://github.com/electric-sql/electric/pull/4081
https://github.com/electric-sql/electric/security/advisories/GHSA-h5rg-pxx7-r2hj
https://nvd.nist.gov/vuln/detail/CVE-2026-40906
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40906.json
https://www.cve.org/CVERecord?id=CVE-2026-40906

History

May 13, 2026 3:45 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Electric Electric sync-service
CPEs		cpe:2.3:a:electric:sync-service::::::::
Vendors & Products		Electric Electric sync-service

Apr 22, 2026 2:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Apr 22, 2026 12:15 PM First appearance in the feed. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
First Time appeared		Electric-sql Electric-sql electric
Vendors & Products		Electric-sql Electric-sql electric
References		https://nvd.nist.gov/vuln/detail/CVE-2026-40906 https://www.cve.org/CVERecord?id=CVE-2026-40906
Metrics	threat_severity `None`	threat_severity `Important`

Apr 22, 2026 12:00 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Electric is a Postgres sync engine. From 1.1.12 to before 1.5.0, the order_by parameter in the ElectricSQL /v1/shape API is vulnerable to error-based SQL injection, allowing any authenticated user to read, write, and destroy the full contents of the underlying PostgreSQL database through crafted ORDER BY expressions. This vulnerability is fixed in 1.5.0.
Title		Electric: SQL Injection via ORDER BY Parameter in Shape API
Weaknesses		CWE-89
References		https://github.com/electric-sql/electric/pull/4081 https://github.com/electric-sql/electric/security/advisories/GHSA-h5rg-pxx7-r2hj
Metrics		cvssV3_1 `{'score': 10, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'}`