CVE-2026-105615

EUVD-2026-112287
PostgreSQL's optimized statistics on a table are visible as long as you have SELECT privilege on said table. A masked role can therefore read a limited subset of the data through the statistics view's histograms and mcvs. The vulnerability is resolved in PostgreSQL Anonymizer 3.3.0 and later versions.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
PostgreSQLCNA
3.5 LOW
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
dalibopostgresql_anonymizer
𝑥
< 3.3.0
CNA
Common Weakness Enumeration
References
https://gitlab.com/dalibo/postgresql_anonymizer/-/issues/693