The PostgreSQL project reports:
PostgreSQL maintains statistics for tables by sampling
data available in columns; this data is consulted during
the query planning process. Prior to this release, a user
able to execute SQL queries with permissions to read a
given column could craft a leaky operator that could
read whatever data had been sampled from that column.
If this happened to include values from rows that the user
is forbidden to see by a row security policy, the user
could effectively bypass the policy. This is fixed by only
allowing a non-leakproof operator to use this data if
there are no relevant row security policies for the table.