Read the docs
TI-2026-23699 Aliases CVE-2026-30870GHSA-q6wc-xx4m-92fj

Some sync filters in PowerSync Service ignored using `config.edition: 3`

Priority LOW 28CWE-285Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-285.

Summary

PowerSync Service is the server-side component of the PowerSync sync engine. In version 1.20.0, when using new sync streams with config.edition: 3, certain subquery filters were ignored when determining which data to sync to users. Depending on the sync stream configuration, this could result in authenticated users syncing data that should have been restricted. Only queries that gate synchronization using subqueries without partitioning the result set are affected. This vulnerability is fixed in 1.20.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00233 14th percentileScored 2026-11-07
Fix Fixed powersync-service (powersync-ja): 1.20.1service-core (@powersync): 1.20.1+3 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
powersync-japowersync-servicebefore 1.20.11.20.1Patch availableCNA
@powersyncservice-corebefore 1.20.11.20.1Patch availableCNA
@powersyncservice-sync-rulesbefore 0.33.00.33.0Patch availableCNA
—@powersync/service-core (npm)1.20.0 to before 1.20.11.20.1Patch availableGHSA-q6wc-xx4m-92fj
—@powersync/service-sync-rules (npm)0.32.0 to before 0.33.00.33.0Patch availableGHSA-q6wc-xx4m-92fj
  • powersync-service Vendorpowersync-ja Affected before 1.20.1 Fixed in 1.20.1 Patch available CNA
  • service-core Vendor@powersync Affected before 1.20.1 Fixed in 1.20.1 Patch available CNA
  • service-sync-rules Vendor@powersync Affected before 0.33.0 Fixed in 0.33.0 Patch available CNA
  • @powersync/service-core (npm) Vendor— Affected 1.20.0 to before 1.20.1 Fixed in 1.20.1 Patch available GHSA-q6wc-xx4m-92fj
  • @powersync/service-sync-rules (npm) Vendor— Affected 0.32.0 to before 0.33.0 Fixed in 0.33.0 Patch available GHSA-q6wc-xx4m-92fj

Remediation

  • Fix · CNA powersync-service (powersync-ja) Fixed in 1.20.1
  • Fix · CNA service-core (@powersync) Fixed in 1.20.1
  • Fix · CNA service-sync-rules (@powersync) Fixed in 0.33.0
  • Fix · GHSA-q6wc-xx4m-92fj @powersync/service-core (npm) Fixed in 1.20.1 Advisory →
  • Fix · GHSA-q6wc-xx4m-92fj @powersync/service-sync-rules (npm) Fixed in 0.33.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-30870
  2. 2026-10-03 Alias added: GHSA-q6wc-xx4m-92fj

References

Advisory 1

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences