Executive brief
Electric Postgres Sync, a tool used to synchronize data between PostgreSQL databases and client applications, contains a flaw that could allow unauthorized users to see sensitive information. By sending specific database queries, an attacker can figure out the contents of data columns they are not supposed to see, even if those columns were intentionally hidden. This could lead to the exposure of private customer data or internal business records that were meant to be restricted.
Technical details
An information disclosure vulnerability exists in Electric Postgres Sync (specifically the sync-service) due to an observable discrepancy when processing 'subset where' clauses. The 'columns' parameter, which was previously documented as a way to restrict access to sensitive fields, only controls which columns are returned in the response but does not prevent those columns from being evaluated in query logic. An authenticated attacker can craft specific 'where' conditions against excluded columns and observe whether rows are returned to iteratively deduce the sensitive values. The issue is addressed in version 1.6.10 by the introduction of a new 'queryable_columns' parameter to explicitly define which fields are accessible for query logic.
Affected products
- ElectricSQL Electric Postgres Sync < 1.6.10
Timeline
- 2026-06-10: advisory: GitHub Security Advisory published
- 2026-07-21: disclosed: NVD publication date