Description
In version 1.20.0, when using new sync streams with config.edition: 3, certain subquery filters were ignored when determining which data to sync to users.
Depending on the sync stream configuration, this could result in authenticated users syncing data that should have been restricted.
Recommendation
Update the @powersync/service-core package to the latest compatible version. Followings are version details:
- Affected version(s): = 1.20.0
- Patched version(s): 1.20.1
References
Could your website be exposed too?
SmartScanner can check your website for PowerSync: Some sync filters ignored on 1.20.0 using `config.edition: 3` - @powersync/service-core and gives you actionable findings to investigate.
Start a free scanRelated Issues
- PowerSync: Some sync filters ignored on 1.20.0 using `config.edition: 3` - CVE-2026-30870
- Angular Expressions - Remote Code Execution using filters - CVE-2026-44643
- Cube Core is vulnerable to Denial of Service (DoS) via crafted request - CVE-2026-25957
- TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection - CVE-2026-47761
You might also like:
See something that needs correcting? Let us knowUpdated March 23, 2026