CVE-2026-30870: PowerSync: Some sync filters ignored on 1.20.0 using `config.edition: 3`

March 7, 2026 (updated March 10, 2026)

In version 1.20.0, when using new sync streams with config.edition: 3, certain subquery filters were ignored when determining which data to sync to users.

Depending on the sync stream configuration, this could result in authenticated users syncing data that should have been restricted.

Only queries that gate synchronization using subqueries without partitioning the result set are affected.

Not affected:

Sync rules (bucket_definitions)
Sync streams using config.edition: 2
No data is exposed without authenticating

References

github.com/advisories/GHSA-q6wc-xx4m-92fj
github.com/powersync-ja/powersync-service
github.com/powersync-ja/powersync-service/security/advisories/GHSA-q6wc-xx4m-92fj
nvd.nist.gov/vuln/detail/CVE-2026-30870

Code Behaviors & Features

Detect and mitigate CVE-2026-30870 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →