DALIBO PostgreSQL Anonymizer information disclosure vulnerability

DALIBO PostgreSQL Anonymizer versions 1 through 3.3.0 contain an information disclosure vulnerability. This occurs because adding rules or changing roles does not invalidate previously prepared plans; as a result, users may still see unmasked data until their session ends...

DALIBO PostgreSQL Anonymizer authorization issue vulnerability

Versions prior to DALIBO PostgreSQL Anonymizer 3.3.0 contain an authorization issue vulnerability. This vulnerability arises because data accessed via the securityinvoker view is not masked, potentially leading to sensitive information leakage...

CVE-2026-105616: Exposure of Sensitive Information to an Unauthorized Actor

PostgreSQL restricts acces to the salt and shift via the SHOW command for users not member of pgreadallsettings. But they are visible in pgdbrolesetting or pgroles if they were set on the database, user or both. PostgreSQL Anonymizer's documentation recommends to use ALTER DATABASE / ALTER ROLE f...

DALIBO PostgreSQL Anonymizer authorization issue vulnerability

Versions prior to DALIBO PostgreSQL Anonymizer 3.3.0 contain an authorization issue vulnerability. This vulnerability arises because data returned by subqueries in rules is not masked, potentially leading to sensitive data leakage...

DALIBO PostgreSQL Anonymizer authorization issue vulnerability

DALIBO PostgreSQL Anonymizer versions 1 through 3.3.0 contain an authorization issue vulnerability. This vulnerability arises because data-modifying CTEs can bypass read-only restrictions imposed by mask roles, potentially leading to privilege escalation...

DALIBO PostgreSQL Anonymizer resource management error vulnerability

Versions of DALIBO PostgreSQL Anonymizer prior to 3.3.0 contain a resource management error vulnerability. This vulnerability arises because range-based virtual functions fail to limit their scope size; it may exhaust backend memory and trigger an OOM termination, resulting in a cluster-wide cras...

DALIBO PostgreSQL Anonymizer information disclosure vulnerability

Versions of DALIBO PostgreSQL Anonymizer prior to 3.3.0 contain an information disclosure vulnerability. This vulnerability stems from static masking and statistical persistence issues; original statistical data remains visible in pgstats until manually or via autovacuum, ANALYZE operations on th...

DALIBO PostgreSQL Anonymizer processing logic error vulnerability

Versions prior to DALIBO PostgreSQL Anonymizer 3.3.0 contain a logic error vulnerability. This vulnerability arises because the Anonymizer only checks for anonymization functions defined using SQL standard function bodies during execution; PostgreSQL performs such checks at declaration time. As a...

DALIBO PostgreSQL Anonymizer processing logic error vulnerability

Versions 1 through 3.3.0 of the DALIBO PostgreSQL Anonymizer contain a logic error vulnerability. This vulnerability arises because the anon.partial and anon.partialemail functions may leak full data when the input size is too small...

DALIBO PostgreSQL Anonymizer information disclosure vulnerability

Versions 1 through 3.3.0 of DALIBO PostgreSQL Anonymizer contain an information disclosure vulnerability. This vulnerability arises because, when SELECT privileges are granted, optimized statistical information on tables becomes visible; mask roles can then read a limited subset of data via...

DALIBO PostgreSQL Anonymizer information disclosure vulnerability

Versions prior to DALIBO PostgreSQL Anonymizer 3.3.0 contain an information disclosure vulnerability. This vulnerability arises because salt and shift can access restricted data via the SHOW command; however, it remains visible in pgdbrolesetting or pgroles, potentially leading to information...

CVE-2026-105615: Exposure of Sensitive Information Through Data Queries

PostgreSQL's optimized statistics on a table are visible as long as you have SELECT privilege on said table. A masked role can therefore read a limited subset of the data through the statistics view's histograms and mcvs. The vulnerability is resolved in PostgreSQL Anonymizer 3.3.0 and later...

DALIBO PostgreSQL Anonymizer resource management error vulnerability

Versions prior to DALIBO PostgreSQL Anonymizer 3.3.0 contain a resource management error vulnerability. This vulnerability arises because the anon.imageblur function fails to validate the declared size of provided images. Attackers can supply small images with excessively large declared sizes,...

DALIBO PostgreSQL Anonymizer authorization issue vulnerability

DALIBO PostgreSQL Anonymizer versions 1 through 3.3.0 contain an authorization issue vulnerability. This vulnerability arises because data is masked when accessing partitions or inherited tables directly; however, the same masking rule is not applied when accessing via parent tables. As a result,...

PostgreSQL Anonymizer SQL Injection Vulnerability

PostgreSQL Anonymizer is an open-source extension developed by DALIBO in France, designed to mask or replace personally identifiable information PII or commercially sensitive data in PostgreSQL databases. PostgreSQL Anonymizer has a SQL injection vulnerability. This vulnerability arises from...

PostgreSQL Anonymizer security vulnerability

PostgreSQL Anonymizer is an open-source extension developed by DALIBO in France, designed to mask or replace personally identifiable information PII or commercially sensitive data in PostgreSQL databases. PostgreSQL Anonymizer has a security vulnerability that stems from allowing users to obtain...

DALIBO PostgreSQL Anonymizer security vulnerability

DALIBO PostgreSQL Anonymizer is an extension software developed by the French company DALIBO. It is designed to mask or replace personally identifiable information PII or commercially sensitive data in PostgreSQL databases. There is a security vulnerability in PostgreSQL Anonymizer, which stems...

DALIBO PostgreSQL Anonymizer security vulnerability

DALIBO PostgreSQL Anonymizer is an extension for masking or replacing personally identifiable information PII or commercially sensitive data in PostgreSQL databases from France DALIBO. A security vulnerability exists in DALIBO PostgreSQL Anonymizer version v2.0 and v2.1, which stems from a...