Description
Electric Postgres Sync versions below 1.6.10 contains an information disclosure vulnerability that allows attackers to infer the values of excluded columns by crafting subset where clause conditions against shape responses. Attackers can observe whether subset where conditions match rows to deduce sensitive field data even though those columns are not returned in shape responses, bypassing column-based access restrictions.
Published: 2026-07-21
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Electric Postgres Sync releases below 1.6.10 permit attackers to deduce values of columns that are not returned in shape responses by crafting subset where clauses. The weakness, classified as CWE‑203, enables an adversary to infer sensitive data through adjacent query logic rather than direct field access, thereby leaking information that should be protected by column‑based access controls.

Affected Systems

ElectricSQL Electric Postgres Sync versions earlier than 1.6.10 are impacted. This affects installations that rely on shape responses for data synchronization and may be exposed through the exposed API endpoints.

Risk and Exploitability

The CVSS score of 5.3 and the EPSS score of 0.00228 (approximately < 1%) indicate a low probability of exploitation in the near term. The vulnerability is not listed in CISA’s KEV catalog. Attackers would need the ability to send crafted subset where clauses to the API, which is typically limited to authenticated clients; however, if that access is compromised, inference attacks become feasible.

Generated by OpenCVE AI on July 30, 2026 at 16:18 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Electric Postgres Sync to version 1.6.10; subset where clauses are protected behind strict authentication and authorization controls
  • Audit and/or restrict shape response metadata to prevent manipulation of schema exposure
  • Implement strict access controls and monitoring to ensure only authorized, authenticated clients can send subset where clauses

Generated by OpenCVE AI on July 30, 2026 at 16:18 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 23 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
First Time appeared Electric-sql
Electric-sql electric Postgres Sync
Vendors & Products Electric-sql
Electric-sql electric Postgres Sync

Wed, 22 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 21 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Description Electric Postgres Sync versions below 1.6.10 contains an information disclosure vulnerability that allows attackers to infer the values of excluded columns by crafting subset where clause conditions against shape responses. Attackers can observe whether subset where conditions match rows to deduce sensitive field data even though those columns are not returned in shape responses, bypassing column-based access restrictions.
Title Electric Postgres Sync Excluded-Column Value Inference via Subset Where Clauses
Weaknesses CWE-203
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Electric-sql Electric Postgres Sync
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-07-22T15:35:06.428Z

Reserved: 2026-07-21T20:57:44.879Z

Link: CVE-2026-65314

cve-icon Vulnrichment

Updated: 2026-07-22T15:34:58.380Z

cve-icon NVD

Status : Deferred

Published: 2026-07-21T22:19:09.907

Modified: 2026-07-23T15:23:01.470

Link: CVE-2026-65314

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-30T16:30:05Z

Weaknesses