CVE-2026-65314

MEDIUM 4.3

Electric Postgres Sync Excluded-Column Value Inference via Subset Where Clauses

CVSS Score

4.3

EPSS Score

0.0%

EPSS Percentile

0th

Electric Postgres Sync versions below 1.6.10 contains an information disclosure vulnerability that allows attackers to infer the values of excluded columns by crafting subset where clause conditions against shape responses. Attackers can observe whether subset where conditions match rows to deduce sensitive field data even though those columns are not returned in shape responses, bypassing column-based access restrictions.

CWE	CWE-203
Vendor	electricsql
Product	electric postgres sync
Published	Jul 21, 2026

Stay Ahead of the Next One

Get instant alerts for electricsql electric postgres sync

Be the first to know when new medium vulnerabilities affecting electricsql electric postgres sync are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

ElectricSQL / Electric Postgres Sync

0 ≤ 1.6.10

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/electric-sql/electric/security/advisories/GHSA-c82q-v86f-c87f github.com: https://github.com/electric-sql/electric vulncheck.com: https://www.vulncheck.com/advisories/electric-postgres-sync-excluded-column-value-inference-via-subset-where-clauses

Credits

🔍 George Chen