Vulnerability in Electricsql Electric Postgres Sync
CVE-2026-65314
Electric Postgres Sync versions below 1.6.10 contains an information disclosure vulnerability that allows attackers to infer the values of excluded columns by crafting subset where clause conditions against shape responses. Attackers can observe whether subset where conditions match rows to deduce sensitive field data even though those columns are not returned in shape responses, bypassing column-based access restrictions.
EPSS: 0.004 (32.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.
Affected products
- Electricsql Electric Postgres Sync — versions 0
Weakness classification (CWE)
References
- disclosure@vulncheck.com (vendor-advisory)
- disclosure@vulncheck.com (patch)
- disclosure@vulncheck.com (third-party-advisory)
Frequently asked questions
- What is CVE-2026-65314?
- CVE-2026-65314 is a medium-severity vulnerability in Electricsql Electric Postgres Sync, classified under Observable Discrepancy. CVSS score: 4.3/10. Published 2026-07-21.
- How severe is CVE-2026-65314?
- Medium severity. CVSS v3 base score is 4.3 out of 10.