CVE-2026-30870: 
JavaScript vulnerability analysis and mitigation

CVE-2026-30870 is an improper authorization vulnerability in PowerSync Service (the server-side component of the PowerSync sync engine) that causes certain subquery-based sync filters to be silently ignored when using config.edition: 3 sync streams. The flaw was introduced in version 1.20.0 of @powersync/service-core (npm) and @powersync/service-sync-rules version 0.32.0, and was disclosed on March 6, 2026, with NVD publication on March 10, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, PowerSync Advisory).

The root cause is classified as CWE-285 (Improper Authorization): when sync streams are configured with config.edition: 3, the service fails to evaluate subquery filters that gate whether a table should be synchronized to a user, effectively treating the filter as always true. Only subqueries used to determine sync eligibility without partitioning the result set are affected — for example, SELECT * FROM sensitive_table WHERE auth.user_id() IN (SELECT user_id FROM admins). Queries that partition data via subqueries (e.g., filtering rows by ownership) are not affected, nor are sync rules using bucket_definitions or streams using config.edition: 2. Exploitation requires a valid authenticated session; no unauthenticated access is possible (GitHub Advisory, PowerSync Advisory).

Successful exploitation allows authenticated users to receive synchronized data they should not have access to, resulting in high confidentiality impact with no integrity or availability impact. Sensitive tables intended to be restricted to specific roles (e.g., admin-only data) could be exposed to any authenticated user of the application. There is no risk of data modification or service disruption, and no data is exposed to unauthenticated parties (GitHub Advisory, PowerSync Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported. The EPSS score is approximately 0.028–0.042%, placing it in the 13th percentile for exploitation likelihood. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires valid credentials and a deployment specifically using config.edition: 3 sync streams with subquery-gated access controls (GitHub Advisory).

1. Authenticate: Obtain valid credentials for the target PowerSync-backed application (e.g., a standard user account that would normally have restricted data access).
2. Identify target deployment: Confirm the PowerSync Service instance is running version 1.20.0 and that sync streams are configured with config.edition: 3.
3. Initiate sync stream: Connect to the PowerSync Service sync endpoint using the authenticated session and request a sync stream for a table protected by a subquery filter (e.g., an admin-only table).
4. Receive restricted data: Because the subquery filter is ignored by the service, the sync stream returns all rows from the restricted table regardless of the user's actual authorization level.
5. Exfiltrate data: The synchronized data is now available on the client device and can be read or extracted by the attacker (GitHub Advisory, PowerSync Advisory).

• Logs: PowerSync service logs showing authenticated users initiating sync streams for tables they should not have access to; unexpected data volume in sync responses for low-privilege accounts.
• Application Data: Client devices belonging to non-admin users containing records from tables that should be restricted (e.g., admin-only tables present in local SQLite databases on client devices).
• Configuration Review: Presence of config.edition: 3 in sync stream configuration combined with subquery-based access control patterns (e.g., WHERE auth.user_id() IN (SELECT user_id FROM admins)) in sync rules (GitHub Advisory).

The vulnerability is fixed in @powersync/service-core version 1.20.1 and @powersync/service-sync-rules version 0.33.0. Upgrading and restarting the service is sufficient — no reprocessing of sync streams is required. PowerSync Cloud instances were automatically updated by the vendor; self-hosted deployments must manually update and restart. After upgrading, any data erroneously synced to unauthorized clients will be automatically removed when those clients reconnect (GitHub Advisory, PowerSync Advisory).

The advisory was published by the PowerSync maintainer (rkistner) directly via GitHub Security Advisories on March 6, 2026, with proactive outreach to affected PowerSync Cloud customers noted in the advisory. Coverage was picked up by vulnerability tracking services including VulDB, cvefeed.io, and INCIBE-CERT shortly after disclosure. No significant independent researcher commentary or social media discussion has been identified beyond standard aggregator coverage (PowerSync Advisory).