AIKIDO-2026-810822

TL;DR

Electric returns shape responses that omit columns restricted by shape access controls, but it still evaluates client supplied where clause conditions against those hidden columns. By issuing subset where clause conditions and observing which rows match, a caller with low-level access infers the values of excluded columns through the response side channel. This discloses confidential column data even though the columns are never returned directly, bypassing the intended column-level restrictions. The fix stops where clause conditions from revealing values of columns that are not exposed in the shape.