The vulnerability allows a masked user without elevated privileges to invoke the anon.hash() function through a sub‑select, repeatedly collecting (seed, hash_output) pairs. By aggregating these values the attacker can perform an offline brute‑force attack and deduce the salt used for data anonymization, effectively breaking the intended privacy guarantees of the extension.

The flaw exists in DALIBO’s PostgreSQL Anonymizer extension for PostgreSQL. Versions older than 3.2.3 are affected; the issue was fixed in release 3.2.3 and later.

The CVSS score is 4.3, indicating moderate severity, and the EPSS score is unavailable. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is through a database connection where a masked user can issue arbitrary SELECT statements; by embedding the call to anon.hash() inside a subquery, the restricted function becomes reachable. Once the attacker gathers sufficient (seed, hash_output) samples, a brute‑force attack offline can recover the salt, thereby compromising all data hashed with that key.