Vulnerability-Lookup

CVE-2026-30870 (GCVE-0-2026-30870)

Vulnerability from cvelistv5 – Published: 2026-03-09 22:31 – Updated: 2026-03-10 14:14

Title

Some sync filters in PowerSync Service ignored using `config.edition: 3`

Summary

PowerSync Service is the server-side component of the PowerSync sync engine. In version 1.20.0, when using new sync streams with config.edition: 3, certain subquery filters were ignored when determining which data to sync to users. Depending on the sync stream configuration, this could result in authenticated users syncing data that should have been restricted. Only queries that gate synchronization using subqueries without partitioning the result set are affected. This vulnerability is fixed in 1.20.1.

Severity ?

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-285 - Improper Authorization

Assigner

GitHub_M

References

URL

Tags

https://github.com/powersync-ja/powersync-service…

x_refsource_CONFIRM

Impacted products

Vendor

Product

Version

powersync-ja

powersync-service

Affected: < 1.20.1

	@powersync	service-core	Affected: < 1.20.1
	@powersync	service-sync-rules	Affected: < 0.33.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-30870",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-10T14:14:10.547827Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-10T14:14:17.271Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "powersync-service",
          "vendor": "powersync-ja",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.20.1"
            }
          ]
        },
        {
          "product": "service-core",
          "vendor": "@powersync",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.20.1"
            }
          ]
        },
        {
          "product": "service-sync-rules",
          "vendor": "@powersync",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.33.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "PowerSync Service is the server-side component of the PowerSync sync engine. In version 1.20.0, when using new sync streams with config.edition: 3, certain subquery filters were ignored when determining which data to sync to users. Depending on the sync stream configuration, this could result in authenticated users syncing data that should have been restricted. Only queries that gate synchronization using subqueries without partitioning the result set are affected. This vulnerability is fixed in 1.20.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285: Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-09T22:31:40.035Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/powersync-ja/powersync-service/security/advisories/GHSA-q6wc-xx4m-92fj",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/powersync-ja/powersync-service/security/advisories/GHSA-q6wc-xx4m-92fj"
        }
      ],
      "source": {
        "advisory": "GHSA-q6wc-xx4m-92fj",
        "discovery": "UNKNOWN"
      },
      "title": "Some sync filters in PowerSync Service ignored using `config.edition: 3`"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-30870",
    "datePublished": "2026-03-09T22:31:40.035Z",
    "dateReserved": "2026-03-06T00:04:56.698Z",
    "dateUpdated": "2026-03-10T14:14:17.271Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-30870\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-03-10T17:40:14.530\",\"lastModified\":\"2026-03-11T13:53:47.157\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"PowerSync Service is the server-side component of the PowerSync sync engine. In version 1.20.0, when using new sync streams with config.edition: 3, certain subquery filters were ignored when determining which data to sync to users. Depending on the sync stream configuration, this could result in authenticated users syncing data that should have been restricted. Only queries that gate synchronization using subqueries without partitioning the result set are affected. This vulnerability is fixed in 1.20.1.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-285\"}]}],\"references\":[{\"url\":\"https://github.com/powersync-ja/powersync-service/security/advisories/GHSA-q6wc-xx4m-92fj\",\"source\":\"security-advisories@github.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-30870\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-03-10T14:14:10.547827Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-03-10T14:14:13.704Z\"}}], \"cna\": {\"title\": \"Some sync filters in PowerSync Service ignored using `config.edition: 3`\", \"source\": {\"advisory\": \"GHSA-q6wc-xx4m-92fj\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"powersync-ja\", \"product\": \"powersync-service\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 1.20.1\"}]}, {\"vendor\": \"@powersync\", \"product\": \"service-core\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 1.20.1\"}]}, {\"vendor\": \"@powersync\", \"product\": \"service-sync-rules\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 0.33.0\"}]}], \"references\": [{\"url\": \"https://github.com/powersync-ja/powersync-service/security/advisories/GHSA-q6wc-xx4m-92fj\", \"name\": \"https://github.com/powersync-ja/powersync-service/security/advisories/GHSA-q6wc-xx4m-92fj\", \"tags\": [\"x_refsource_CONFIRM\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"PowerSync Service is the server-side component of the PowerSync sync engine. In version 1.20.0, when using new sync streams with config.edition: 3, certain subquery filters were ignored when determining which data to sync to users. Depending on the sync stream configuration, this could result in authenticated users syncing data that should have been restricted. Only queries that gate synchronization using subqueries without partitioning the result set are affected. This vulnerability is fixed in 1.20.1.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-285\", \"description\": \"CWE-285: Improper Authorization\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-03-09T22:31:40.035Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-30870\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-03-10T14:14:17.271Z\", \"dateReserved\": \"2026-03-06T00:04:56.698Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-03-09T22:31:40.035Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

GHSA-Q6WC-XX4M-92FJ

Vulnerability from github – Published: 2026-03-07 02:23 – Updated: 2026-03-10 18:43

Summary

PowerSync: Some sync filters ignored on 1.20.0 using `config.edition: 3`

Details

Impact

In version 1.20.0, when using new sync streams with config.edition: 3, certain subquery filters were ignored when determining which data to sync to users.

Depending on the sync stream configuration, this could result in authenticated users syncing data that should have been restricted.

Only queries that gate synchronization using subqueries without partitioning the result set are affected.

Not affected: * Sync rules (bucket_definitions) * Sync streams using config.edition: 2 * No data is exposed without authenticating

Patches

The issue is fixed in 1.20.1. Restarting the service with the new version is sufficient - no reprocessing of sync streams is required.

Any data that users erroneously synced will be automatically removed from those devices when they connect again.

PowerSync has updated all affected PowerSync Cloud instances to the fixed version, and is reaching out to affected customers.

For self-hosted PowerSync instances, update to the latest version and restart.

Affected queries

Subqueries used only to determine whether or not a table should be synced (without partitioning the data itself) are affected. Examples:

-- Goal: Sync a table only to admin users
-- 1.20.0: all authenticated users would sync this table
SELECT * FROM sensitive_table WHERE auth.user_id() IN (SELECT user_id FROM admins)
SELECT * FROM sensitive_table WHERE 1 IN (SELECT 1 FROM users WHERE id = auth.user_id() AND is_admin = TRUE)

-- Goal: Sync a table only if authorized
-- 1.20.0: all authenticated users would sync this table
SELECT * FROM sensitive_table WHERE 'sensitive_table' IN (SELECT table_name FROM synced_table WHERE "user" = auth.user_id())
SELECT * FROM sensitive_table WHERE 'sensitive_table' IN auth.parameter('allowed_tables')

Queries that partition data (for example SELECT * FROM sensitive_table WHERE owner IN (SELECT id FROM users WHERE is_admin AND id = auth.user_id())) are not affected by this issue.

Severity ?

6.5 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.20.0"
      },
      "package": {
        "ecosystem": "npm",
        "name": "@powersync/service-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.20.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.32.0"
      },
      "package": {
        "ecosystem": "npm",
        "name": "@powersync/service-sync-rules"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.33.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-30870"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-285"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-07T02:23:24Z",
    "nvd_published_at": "2026-03-10T17:40:14Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nIn version **1.20.0**, when using new sync streams with `config.edition: 3`, certain subquery filters were ignored when determining which data to sync to users.\n\nDepending on the sync stream configuration, this could result in authenticated users syncing data that should have been restricted.\n\nOnly queries that gate synchronization using subqueries without partitioning the result set are affected.\n\nNot affected:\n * Sync rules (bucket_definitions)\n * Sync streams using `config.edition: 2`\n * No data is exposed without authenticating\n\n### Patches\n\nThe issue is **fixed in 1.20.1**. Restarting the service with the new version is sufficient - no reprocessing of sync streams is required.\n\nAny data that users erroneously synced will be automatically removed from those devices when they connect again.\n\nPowerSync has updated all affected PowerSync Cloud instances to the fixed version, and is reaching out to affected customers.\n\nFor self-hosted PowerSync instances, update to the latest version and restart.\n\n### Affected queries\n\nSubqueries used only to determine whether or not a table should be synced (without partitioning the data itself) are affected. Examples:\n\n```sql\n-- Goal: Sync a table only to admin users\n-- 1.20.0: all authenticated users would sync this table\nSELECT * FROM sensitive_table WHERE auth.user_id() IN (SELECT user_id FROM admins)\nSELECT * FROM sensitive_table WHERE 1 IN (SELECT 1 FROM users WHERE id = auth.user_id() AND is_admin = TRUE)\n\n-- Goal: Sync a table only if authorized\n-- 1.20.0: all authenticated users would sync this table\nSELECT * FROM sensitive_table WHERE \u0027sensitive_table\u0027 IN (SELECT table_name FROM synced_table WHERE \"user\" = auth.user_id())\nSELECT * FROM sensitive_table WHERE \u0027sensitive_table\u0027 IN auth.parameter(\u0027allowed_tables\u0027)\n```\n\nQueries that partition data (for example `SELECT * FROM sensitive_table WHERE owner IN (SELECT id FROM users WHERE is_admin AND id = auth.user_id())`) are not affected by this issue.",
  "id": "GHSA-q6wc-xx4m-92fj",
  "modified": "2026-03-10T18:43:23Z",
  "published": "2026-03-07T02:23:24Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/powersync-ja/powersync-service/security/advisories/GHSA-q6wc-xx4m-92fj"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-30870"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/powersync-ja/powersync-service"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "PowerSync: Some sync filters ignored on 1.20.0 using `config.edition: 3`"
}

FKIE_CVE-2026-30870

Vulnerability from fkie_nvd - Published: 2026-03-10 17:40 - Updated: 2026-03-11 13:53

Severity ?

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/powersync-ja/powersync-service/security/advisories/GHSA-q6wc-xx4m-92fj

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "PowerSync Service is the server-side component of the PowerSync sync engine. In version 1.20.0, when using new sync streams with config.edition: 3, certain subquery filters were ignored when determining which data to sync to users. Depending on the sync stream configuration, this could result in authenticated users syncing data that should have been restricted. Only queries that gate synchronization using subqueries without partitioning the result set are affected. This vulnerability is fixed in 1.20.1."
    },
    {
      "lang": "es",
      "value": "PowerSync Service es el componente del lado del servidor del motor de sincronizaci\u00f3n PowerSync. En la versi\u00f3n 1.20.0, al usar nuevas transmisiones de sincronizaci\u00f3n con config.edition: 3, ciertos filtros de subconsulta fueron ignorados al determinar qu\u00e9 datos sincronizar con los usuarios. Dependiendo de la configuraci\u00f3n de la transmisi\u00f3n de sincronizaci\u00f3n, esto podr\u00eda resultar en que usuarios autenticados sincronicen datos que deber\u00edan haber sido restringidos. Solo las consultas que controlan la sincronizaci\u00f3n usando subconsultas sin particionar el conjunto de resultados se ven afectadas. Esta vulnerabilidad est\u00e1 corregida en la 1.20.1."
    }
  ],
  "id": "CVE-2026-30870",
  "lastModified": "2026-03-11T13:53:47.157",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-03-10T17:40:14.530",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/powersync-ja/powersync-service/security/advisories/GHSA-q6wc-xx4m-92fj"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-285"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-30870 (GCVE-0-2026-30870)

GHSA-Q6WC-XX4M-92FJ

Impact

Patches

Affected queries

FKIE_CVE-2026-30870

Tags

Sightings

Nomenclature