CVE-2026-54698: CWE-863: Incorrect Authorization in hasura graphql-engine
Hasura is an open-source product that provides users GraphQL or REST APIs. Prior to 2.49.2 and 2.45.5, a user can use a where clause on a table computed field (returning SETOF some_table) to infer row values that ought to be filtered for their role based on some_table's row-level permissions. While such rows cannot be returned directly, like predicates on strings for instance allow values to be brute forced efficiently with the where clause as an oracle. This issue is fixed in versions 2.49.2 and 2.45.5.
AI Analysis
Technical Summary
CVE-2026-54698 is an incorrect authorization vulnerability (CWE-863) in Hasura graphql-engine. Before versions 2.49.2 and 2.45.5, a user could exploit the where clause on a table computed field returning SETOF some_table to infer data values that should have been filtered by row-level permissions. While direct access to these rows is blocked, the vulnerability allows efficient brute forcing of string predicates using the where clause as an oracle. This could lead to unauthorized inference of sensitive data. The vulnerability has a CVSS 4.0 score of 6.0 (medium severity).
Potential Impact
An attacker with limited privileges can infer sensitive row data that should be restricted by role-based row-level permissions. Although the rows are not directly accessible, the vulnerability enables brute forcing of string values through the where clause, potentially exposing confidential information indirectly.
Mitigation Recommendations
This vulnerability is fixed in Hasura graphql-engine versions 2.49.2 and 2.45.5. Users should upgrade to at least these versions to remediate the issue. Patch status is confirmed by the version fixes stated in the description. No additional mitigations are indicated.
CVE-2026-54698: CWE-863: Incorrect Authorization in hasura graphql-engine
Description
Hasura is an open-source product that provides users GraphQL or REST APIs. Prior to 2.49.2 and 2.45.5, a user can use a where clause on a table computed field (returning SETOF some_table) to infer row values that ought to be filtered for their role based on some_table's row-level permissions. While such rows cannot be returned directly, like predicates on strings for instance allow values to be brute forced efficiently with the where clause as an oracle. This issue is fixed in versions 2.49.2 and 2.45.5.
CVSS v4.0
Score 6.0medium
Affected software
pkg:github/hasura/graphql-engineRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-54698 is an incorrect authorization vulnerability (CWE-863) in Hasura graphql-engine. Before versions 2.49.2 and 2.45.5, a user could exploit the where clause on a table computed field returning SETOF some_table to infer data values that should have been filtered by row-level permissions. While direct access to these rows is blocked, the vulnerability allows efficient brute forcing of string predicates using the where clause as an oracle. This could lead to unauthorized inference of sensitive data. The vulnerability has a CVSS 4.0 score of 6.0 (medium severity).
Potential Impact
An attacker with limited privileges can infer sensitive row data that should be restricted by role-based row-level permissions. Although the rows are not directly accessible, the vulnerability enables brute forcing of string values through the where clause, potentially exposing confidential information indirectly.
Mitigation Recommendations
This vulnerability is fixed in Hasura graphql-engine versions 2.49.2 and 2.45.5. Users should upgrade to at least these versions to remediate the issue. Patch status is confirmed by the version fixes stated in the description. No additional mitigations are indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-15T22:58:06.562Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a4d7350c9d9e3dbe3e36b21
Added to database: 07/07/2026, 21:44:48 UTC
Last enriched: 07/15/2026, 12:16:55 UTC
Last updated: 08/20/2026, 10:52:10 UTC
Views: 118
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.