# CVE-2026-54698: Hasura: Row-level authorization bypass on table computed fields

> CVE-2026-54698: Hasura: Row-level authorization bypass on table computed fields. CVSS 5.9 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-54698
Last updated: 2026-10-25T20:10:00Z

- Published: 2026-07-07 21:29 UTC · Updated: 2026-10-25 20:10 UTC · Assigner: GitHub\_M
- CVSS: 5.9 (CVSS 3.1) · Severity: Medium · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS: 0.27%, 20th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-863

## Description

Hasura is an open-source product that provides users GraphQL or REST APIs. Prior to 2.49.2 and 2.45.5, a user can use a where clause on a table computed field (returning SETOF some\_table) to infer row values that ought to be filtered for their role based on some\_table's row-level permissions. While such rows cannot be returned directly, like predicates on strings for instance allow values to be brute forced efficiently with the where clause as an oracle. This issue is fixed in versions 2.49.2 and 2.45.5.

## Affected vendors and products

- hasura: graphql-engine

## Tracked companies

- [Hasura](https://rewindex.com/company/hasura.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-54698)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-54698)
- [https://github.com/hasura/graphql-engine/security/advisories/GHSA-r27x-gc74-qmxh](https://github.com/hasura/graphql-engine/security/advisories/GHSA-r27x-gc74-qmxh)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-54698 · Markdown: https://rewindex.com/cve/CVE-2026-54698.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-54698 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T02:49:27.061Z