GHSA-7gw2-974x-qhrh: 
Rust Analyse et atténuation de la vulnérabilité

Audit finding RLS-3 (2026-11-09 audit, follow-up deep pass), severity medium. Audited revision b7c8030f; line numbers refer to it. Static reading with upstream documentation; nothing was executed. Reproduce with a failing test before changing code.

Problem

__graphql_orm_search_<table> (document text and vector) and __graphql_orm_change_log (entity, key, action, actor) are created without ENABLE/FORCE or policies; the RLS plan only touches the entity table. The runtime role needs DML on them, so any SQL path outside the ORM's own search query can read or alter every tenant's searchable text. The ORM's own search joins the base table and stays filtered.

Where

crates/graphql-orm/src/graphql/orm/migrations.rs:2201-2207; crates/graphql-orm/src/graphql/orm/search.rs:1225-1262; crates/graphql-orm/src/graphql/orm/backup.rs:16, :436-448; crates/graphql-orm/src/graphql/orm/rls.rs:59

Suggested fix

For RLS entities emit ENABLE/FORCE on the search table with a policy such as USING (EXISTS (SELECT 1 FROM <base> b WHERE b.<pk>::text = entity_pk)); add a tenant column and policy to the change log or document it as privileged-only.

Acceptance

• A regression test fails before the change and passes after it.
• Docs and changelog state the corrected behaviour. Filed as a private draft advisory.