CVE-2026-19633 HIGH

CVE-2026-19633: PostgreSQL Anonymizer: unprivileged masked users can execute code via operators, domain casts and view subqueries

Vendor Dalibo
Product PostgreSQL Anonymizer
Weakness CWE-89 · SQLi
Published September 6, 2026
Last update September 6, 2026
View on NVD All CVEs

CVSS base score

8.8/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to execute arbitrary code by abusing operators, domain casts, or view subqueries that carry untrusted expressions. When these objects are evaluated in the context of the extension’s masking mechanisms, the malicious code can run with elevated privileges. The issue is fixed in PostgreSQL Anonymizer 3.1.4 and later versions

Key dates

02Disclosure timeline

September 6, 2026 CVE published

Related vulnerabilities

04Related CVE

CVE-2026-16586 Contest Gallery <= 30.0.6 - Authenticated (Author+) Second-Order SQL Injection via MultipleFiles Second-Order Payload via 'cg_multiple_files_for_post' -> 'cgRealId' CVE-2026-73346 WordPress MailChimp For WooCommerce plugin < 6.2 - SQL Injection vulnerability CVE-2026-77823 LearnPress <= 4.4.4 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter CVE-2026-61969 WordPress Listdom plugin <= 5.6.0 - SQL Injection vulnerability CVE-2026-77189 Charitable <= 1.8.12.1 - Authenticated (Contributor+) SQL Injection via 'order' Shortcode Attribute