Executive brief
PowerSync is a real-time data synchronization platform used to replicate database contents to client devices. In version 1.20.0 with config.edition: 3, certain access control filters on synchronized data were incorrectly ignored, allowing authenticated users to access sensitive tables that should have been restricted to their role (e.g., admin-only data). Patches were released immediately for all affected instances.
Technical details
PowerSync version 1.20.0 introduced a privilege escalation bug in its sync stream query processing (CWE-285: Improper Authorization). The vulnerability affects subquery-based authorization filters used to gate table-level access—specifically, queries that use subqueries to determine whether a table should be synced without partitioning the result set itself. Authenticated users can exploit this by connecting to an affected PowerSync instance; the service will incorrectly sync restricted tables to them even when auth checks should have denied access. The root cause is in the edition 3 query evaluation logic. Patches are available: @powersync/service-core 1.20.1+ and @powersync/service-sync-rules 0.33.0+. Data erroneously synced is automatically purged from client devices on reconnection.
Affected products
- PowerSync service-core 1.20.0 (fixed in 1.20.1)
- PowerSync service-sync-rules 0.32.0 (fixed in 0.33.0)
Timeline
- 2026-03-07: disclosed: Advisory published; GHSA-q6wc-xx4m-92fj assigned
- 2026-03-07: patched: Patches released: service-core 1.20.1 and service-sync-rules 0.33.0