When setting EntityOptions.apiPrefilter to a function, the filter is not applied to API requests for a resource by Id

Description

If you used the apiPrefilter option of the @Entity decorator, by setting it to a function that returns a filter that prevents unauthorized access to data, an attacker who knows the id of an entity instance she is not authorized to access, can gain read, update and delete access to it.

Recommendation

Update the remult package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.20.6
• Patched version(s): 0.20.6

References

• GHSA-7hh3-3x64-v2g9
• CVE-2023-35167
• CWE-284
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6