GHSA-f7xj-6695-ww2q: 
Rust vulnerability analysis and mitigation

Audit finding RUN-2 (2026-11-09 audit, follow-up deep pass), severity medium. Audited revision b7c8030f; line numbers refer to it. Static reading with upstream documentation; nothing was executed. Reproduce with a failing test before changing code.

Problem

The generated ORDER BY term is (SELECT COUNT(*) FROM <target> WHERE <key join>) with no target visibility predicate, entity-access check or relation read_policy check. A caller who can list parents can order by ChildCount and learn relative counts of children they cannot read. Opt-in attribute; no effect when PostgreSQL RLS covers the target.

Where

crates/graphql-orm-macros/src/entity.rs:4180-4261, emitted at :5726

Suggested fix

Reject order_aggregate with read_policy; at request time check target access and AND the SQL visibility predicate into the count, failing closed for callback-only policies as relation(filter) does.

Acceptance

• A regression test fails before the change and passes after it.
• Docs and changelog state the corrected behaviour. Filed as a private draft advisory.