CVE-2026-65314

Name of the Vulnerable Software and Affected Versions Electric Postgres Sync versions prior to 1.6.10

Description An information disclosure issue allows attackers to infer values of excluded columns by crafting subset where clause conditions against shape responses. By observing whether these conditions match rows, attackers can deduce sensitive field data, effectively bypassing column-based access restrictions even when the columns are not returned in the responses.

Recommendations Update Electric Postgres Sync to version 1.6.10 or later.