CVE-2025-5690
Cursor allows PostgreSQL Anonymizer masked user to gain unauthorized access to authentic data
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Cursor allows PostgreSQL Anonymizer masked user to gain unauthorized access to authentic data
PostgreSQL Anonymizer v2.0 and v2.1 contain a vulnerability that allows a masked user to bypass the masking rules defined on a table and read the original data using a database cursor or the --insert option of pg_dump. This problem occurs only when dynamic masking is enabled, which is not the default setting. The problem is resolved in version 2.2.1
Reserved 2025-06-04 | Published 2025-06-04 | Updated 2025-06-05 | Assigner PostgreSQLExposure of Sensitive Information to an Unauthorized Actor
The PostgreSQL Anonymizer project thanks Jukka Heiskanen for reporting this problem.
gitlab.com/dalibo/postgresql_anonymizer/-/issues/531
Support options
