Skip to content
CVE PROGRAM SOURCE RECORD3.5 Low

CVE-2026-105615

PostgreSQL Anonymizer: Masked roles can read the statistics of masked columns in pg_stats

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
PostgreSQL

Description

PostgreSQL's optimized statistics on a table are visible as long as you have SELECT privilege on said table. A masked role can therefore read a limited subset of the data through the statistics view's histograms and mcvs. The vulnerability is resolved in PostgreSQL Anonymizer 3.3.0 and later versions.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

DALIBO PostgreSQL Anonymizer

Default version status: unaffected

  • 1 to < 3.3.0affected

References