CVE-2026-40906 is a critical SQL injection vulnerability (CWE-89) affecting ElectricSQL, a Postgres sync engine. The issue exists in the order_by parameter of the /v1/shape API endpoint in versions >= 1.1.12 and < 1.5.0. Authenticated users can exploit error-based SQL injection to fully compromise the underlying PostgreSQL database, including reading, writing, and deleting data. The vulnerability has a CVSS 3.1 base score of 10.0, indicating maximum severity. The vulnerability is resolved in ElectricSQL version 1.5.0. No vendor advisory or patch link is currently provided.

Exploitation allows any authenticated user to execute arbitrary SQL commands via the order_by parameter, resulting in full read, write, and deletion access to the PostgreSQL database underlying ElectricSQL. This compromises confidentiality, integrity, and availability of the data managed by the affected versions.

Upgrade ElectricSQL to version 1.5.0 or later, where this SQL injection vulnerability is fixed. Since no official patch or advisory is provided in the data, users should verify the upgrade path and confirm the fix with the vendor or official ElectricSQL release notes before deployment. Until upgraded, restrict access to authenticated users and monitor for suspicious activity related to the /v1/shape API.