CVE-2026-30870
Medium · 6.5CVSS
6.5
EPSS
0.4%
Published
Mar 10, 2026
CISA due date
—
The record
PowerSync Service is the server-side component of the PowerSync sync engine. In version 1.20.0, when using new sync streams with config.edition: 3, certain subquery filters were ignored when determining which data to sync to users. Depending on the sync stream configuration, this could result in authenticated users syncing data that should have been restricted. Only queries that gate synchronization using subqueries without partitioning the result set are affected. This vulnerability is fixed in 1.20.1.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @powersync/service-core | 1.20.0 | 1.20.1 |
| npm | @powersync/service-sync-rules | 0.32.0 | 0.33.0 |
Related vulnerabilities
- GHSA-q6wc-xx4m-92fj PowerSync: Some sync filters ignored on 1.20.0 using `config.edition: 3` Same vulnerability
- CVE-2026-85543 Some Wi-Fi series camera products have insufficient permission validation on certain… CWE-285
- CVE-2026-21097 Improper authentication in ActivityTaskManagerService prior to SMR Sep-2026 Release 1… CWE-285
- CVE-2026-86804 A vulnerability was identified in seakee CPA-Manager-Plus up to 1.11.10. CWE-285
- CVE-2026-86277 A vulnerability has been found in SourceCodester Syllabus-Aligned Learning Management &… CWE-285
- CVE-2026-86283 MISP's UiBeta theme collection view (app/View/Themed/UiBeta/Collections/view.ctp)… CWE-285
- CVE-2026-86212 A vulnerability has been found in Open5GS 2.7.7/2.8.0. CWE-285
- CVE-2026-86183 A vulnerability was identified in diem-project diem up to 5.1.3. CWE-285