CVE-2026-105619

MediumCVSS 6.5/10Last modified Nov 12, 2026

Description

PostgreSQL Anonymizer doesn't mask data accessed thru a security_invoker view. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
DALIBO	PostgreSQL Anonymizer	>= 1, < 3.3.0

References

https://gitlab.com/dalibo/postgresql_anonymizer/-/issues/697Broken Link

Timeline

Published: Oct 28, 2026
Last modified: Nov 12, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-105625.9An unauthenticated URL redirection vulnerability has been identified in Archer AX20 V2 due to improper validation of user-supplied URL input CVE-2026-1056206.5PostgreSQL Anonymizer doesn't mask data returned by a sub-query in a rule. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later CVE-2026-1056215.4A security flaw has been discovered in jishenghua jshERP up to 3.5. Affected is the function updateAccountHeadAndDetail of the file jshERP-b CVE-2026-1056226.3Improper restriction of excessive authentication attempts in the WAMP-CRA (challenge-response) authentication path in Zenitel Connect before CVE-2026-1056236.9The web interface in Zenitel Connect before 1.11.0 serves production JavaScript source maps without authentication, which allows remote atta CVE-2026-1056246.9The login flow in Zenitel Connect before 1.11.0 applies per-account lockout on repeated failed login attempts, which allows remote attackers CVE-2026-1056255.1The web interface in Zenitel Connect before 1.11.0 loads an integration iframe without sandboxing or origin restrictions, which allows remot CVE-2026-1056267.5HashiCorp Consul and Consul Enterprise are vulnerable to a denial of service in the HTTP API that may allow an unauthenticated attacker to e CVE-2026-1056287.6Plane is an open-source project management tool. Prior to 1.4.0, Plane's OAuth avatar synchronization flow fetches avatar_url from provider CVE-2026-1056297.1Plane is an open-source project management tool. Prior to 1.4.0, BulkEstimatePointEndpoint.destroy resolves an estimate point through a bare CVE-2026-1056308.7Plane is an open-source project management tool. Prior to 1.4.0, an authenticated low-privilege workspace member, including a Guest, can upl CVE-2026-1056317.5Plane is an open-source project management tool. Prior to 1.4.0, WorkspaceFileAssetEndpoint.get and WorkspaceAssetDownloadEndpoint.get resol