PT-2026-62411 · Electricsql · Electric Postgres Sync

George Chen · CVE-2026-65314 · Published 2026-07-21 · Updated 2026-07-21

NVD

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Electric Postgres Sync versions below 1.6.10 contains an information disclosure vulnerability that allows attackers to infer the values of excluded columns by crafting subset where clause conditions against shape responses. Attackers can observe whether subset where conditions match rows to deduce sensitive field data even though those columns are not returned in shape responses, bypassing column-based access restrictions.

Fix

Side Channel Attack

Weakness Enumeration

CWE-203

Related Identifiers

CVE-2026-65314

Affected Products

Electric Postgres Sync

References · 4

• https://github.com/electric-sql/electric · Patch
• https://github.com/electric-sql/electric/security/advisories/GHSA-c82q-v86f-c87f · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-65314 · Security Note
• https://vulncheck.com/advisories/electric-postgres-sync-excluded-column-value-inference-via-subset-where-clauses · Note