CVE-2026-40906

Electric is a Postgres sync engine. From 1.1.12 to before 1.5.0, the order_by parameter in the ElectricSQL /v1/shape API is vulnerable to error-based SQL injection, allowing any authenticated user to read, write, and destroy the full contents of the underlying PostgreSQL database through crafted ORDER BY expressions. This vulnerability is fixed in 1.5.0.

CVSS v3 9.9 CRITICAL

9.9^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.1 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/electric-sql/electric/pull/4081	Exploit Issue Tracking
https://github.com/electric-sql/electric/security/advisories/GHSA-h5rg-pxx7-r2hj	Exploit Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-40906
https://bugzilla.redhat.com/show_bug.cgi?id=2460291
https://github.com/electric-sql/electric/security/advisories/GHSA-h5rg-pxx7-r2hj	Exploit Vendor Advisory
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40906.json

Configurations

Configuration 1 (hide)

cpe:2.3:a:electric:sync-service:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-04-21 21:16

Updated : 2026-07-15 02:21

NVD link : CVE-2026-40906

Mitre link : CVE-2026-40906

CVE.ORG link : CVE-2026-40906

JSON object : View

Products Affected

electric

sync-service

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2026-40906", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40906", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-22T13:46:48.727407Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.1}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "electric-sql", "product": "electric", "versions": [{"status": "affected", "version": ">= 1.1.12, < 1.5.0"}]}]}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "affectedData": [{"cpes": ["cpe:/a:redhat:rhdh:1"], "vendor": "Red Hat", "product": "Red Hat Developer Hub", "packageName": "rhdh/backstage-community-plugin-catalog-backend-module-scaffolder-relation-processor", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}]}], "published": "2026-04-21T21:16:44.697", "references": [{"url": "https://github.com/electric-sql/electric/pull/4081", "tags": ["Exploit", "Issue Tracking"], "source": "security-advisories@github.com"}, {"url": "https://github.com/electric-sql/electric/security/advisories/GHSA-h5rg-pxx7-r2hj", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2026-40906", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460291", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://github.com/electric-sql/electric/security/advisories/GHSA-h5rg-pxx7-r2hj", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}, {"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40906.json", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-89"}]}, {"type": "Secondary", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "Electric is a Postgres sync engine. From 1.1.12 to before 1.5.0, the order_by parameter in the ElectricSQL /v1/shape API is vulnerable to error-based SQL injection, allowing any authenticated user to read, write, and destroy the full contents of the underlying PostgreSQL database through crafted ORDER BY expressions. This vulnerability is fixed in 1.5.0."}], "lastModified": "2026-07-15T02:21:09.930", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:electric:sync-service:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3D00A7C9-9FEC-484A-8B51-FEB621D8D022", "versionEndExcluding": "1.5.0", "versionStartIncluding": "1.1.12"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}