GHSA-rqmg-p367-f63r: 
PHP vulnerability analysis and mitigation

Impact

Column rawQueries entries that use an orWhere* method (used by PowerGrid's Column::searchableRaw() and Column::searchableJson()) were applied at the top level of the query, after the search group. Because the condition was OR-ed at the root, it bypassed constraints defined in the grid datasource, so a user with access to the grid search could list rows outside the intended scope. Exports and summaries share the same pipeline.

Patches

Fixed in 0.14.1: orWhere* raw queries are applied inside the search group.

Workarounds

Upgrade, or avoid searchableRaw() / searchableJson() on grids whose datasource restricts rows.

References

Reported against power-components/livewire-powergrid (GHSA-wj8p-8c55-266p).