Description
In version 1.20.0, when using new sync streams with config.edition: 3, certain subquery filters were ignored when determining which data to sync to users.
Depending on the sync stream configuration, this could result in authenticated users syncing data that should have been restricted.
Recommendation
Update the @powersync/service-sync-rules package to the latest compatible version. Followings are version details:
- Affected version(s): = 0.32.0
- Patched version(s): 0.33.0
References
Could your website be exposed too?
SmartScanner can check your website for PowerSync: Some sync filters ignored on 1.20.0 using `config.edition: 3` and gives you actionable findings to investigate.
Start a free scanRelated Issues
- PowerSync: Some sync filters ignored on 1.20.0 using `config.edition: 3` - @powersync/service-core - CVE-2026-30870
- Angular Expressions - Remote Code Execution using filters - CVE-2026-44643
- stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop - CVE-2026-71429
- Nuxt dev server exposes private runtime config through the Nitro dev bundle - CVE-2026-119199
You might also like:
See something that needs correcting? Let us knowUpdated March 23, 2026