CVE-2026-65314 Details

A vulnerability in Electric Postgres Sync versions prior to 1.6.10 allows for information disclosure by enabling attackers to infer the values of excluded columns. This is achieved by crafting subset where clause conditions that are evaluated against shape responses. Although the excluded columns are not included in the shape responses, the matching of where conditions can be used to deduce sensitive data, thereby circumventing column-based access controls.

Users are advised to upgrade to Electric Postgres Sync version 1.6.10 or later. After upgrading, set the 'queryable_columns' parameter to include only the columns that the client should access. The 'columns' parameter should be used to specify which columns to sync, excluding those not in 'queryable_columns'. If 'columns' is omitted, all columns in 'queryable_columns' will be synced. Note that 'queryable_columns' only restricts access to subset where clauses; shape where clauses are not affected and should be managed as a server-side configuration.