Graphql Engine
Approved changes feed: RSS · Atom
cpe:2.3:a:hasura:graphql-engine:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Hasura (06d0bbac-ff6d-5740-8bd3-432231a37a86) |
|---|---|
| Product | Graphql Engine (6d3200a9-f9d8-58a0-ba9e-31c414599f0f) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-54698 |
vulnerable | 2026-07-29 01:00:27.928893 |
Hasura: Row-level authorization bypass on table computed fields
Hasura is an open-source product that provides users GraphQL or REST APIs. Prior to 2.49.2 and 2.45.5, a user can use a where clause on a table computed field (returning SETOF some_table) to infer row values that ought to be filtered for their role based on some_table's row-level permissions. While such rows cannot be returned directly, like predicates on strings for instance allow values to be brute forced efficiently with the where clause as an oracle. This issue is fixed in versions 2.49.2 and 2.45.5.
Published: 2026-07-07T21:29:23.595Z
Updated: 2026-07-08T13:02:17.049Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-27588 |
vulnerable | 2026-06-08 05:57:42.087814 |
Unauthenticated path traversal vulnerability in Hasura GraphQL Engine
HIGH (7.5)
Hasura is an open-source product that provides users GraphQL or REST APIs. A path traversal vulnerability has been discovered within Hasura GraphQL Engine prior to versions 1.3.4, 2.55.1, 2.20.1, and 2.21.0-beta1. Projects running on Hasura Cloud were not vulnerable. Self-hosted Hasura Projects with deployments that are publicly exposed and not protected by a WAF or other HTTP protection layer should be upgraded to version 1.3.4, 2.55.1, 2.20.1, or 2.21.0-beta1 to receive a patch.
Published: 2023-03-14T17:23:10.499Z
Updated: 2025-02-25T14:57:42.725Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.