CVE-2026-105615: falha de baixa gravidade em DALIBO PostgreSQL Anonymizer
PostgreSQL Anonymizer: Masked roles can read the statistics of masked columns in pg_stats
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
8Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 3.5epss 0.1%
PostgreSQL's optimized statistics on a table are visible as long as you have SELECT privilege on said table. A masked role can therefore read a limited subset of the data through the statistics view's histograms and mcvs. The vulnerability is resolved in PostgreSQL Anonymizer 3.3.0 and later versions.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
Produtos afetados
DALIBO · PostgreSQL AnonymizerCVEs relacionadas — DALIBO PostgreSQL Anonymizer
No mesmo produto, das mais perigosas para as menos.
CVE-2026-19633HIGHPostgreSQL Anonymizer: unprivileged masked users can execute code via operators, domain casts and view subqueriesEPSS 0.7%CVE-2024-2339HIGHImproper Input Validation in PostgreSQL Anonymizer 1.2 allows table owner to gain superuser privileges via masking ruleEPSS 0.6%CVE-2026-2360HIGHImproper search_path protection in PostgreSQL Anonymizer 2.5 allows any user to gain superuser privileges in PostgreSQL 14EPSS 0.5%CVE-2024-2338HIGHSQL Injection in PostgreSQL Anonymizer 1.2 allows table owner to gain superuser privileges via masking ruleEPSS 0.5%CVE-2025-5690MEDIUMCursor allows PostgreSQL Anonymizer masked user to gain unauthorized access to authentic dataEPSS 0.4%CVE-2026-83534MEDIUMPostgreSQL Anonymizer: Privilege escalation to superuser via anon.anonymize_database_parallel()EPSS 0.3%