CVE-2026-30870CWE-285

Some sync filters in PowerSync Service ignored using `config.edition: 3`

Medium · published March 9, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
27.9
In the wild
Unconfirmed
What it is

PowerSync Service is the server-side component of the PowerSync sync engine. In version 1.20.0, when using new sync streams with config.edition: 3, certain subquery filters were ignored when determining which data to sync to users. Depending on the sync stream configuration, this could result in authenticated users syncing data that should have been restricted. Only queries that gate synchronization using subqueries without partitioning the result set are affected. This vulnerability is fixed in 1.20.1.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00354 · 27.9th percentile
Weakness
CWE-285 · Improper Authorization
Published
2026-03-09T22:31Z
EPSS history
Timeline
  • 09 MAR 22:31Z
    Some sync filters in PowerSync Service ignored using `config.edition: 3`
    cvelistv5