{"id":"CVE-2022-46792","aliases":["EUVD-2022-49574","GHSA-g7mj-g7f4-hgrg","GHSA-jfv6-7jf3-3v86"],"status":"published","title":"Hasura GraphQL Engine before 2.15.2 mishandles row-level authorization in the Update Many API for...","description":"Hasura GraphQL Engine before 2.15.2 mishandles row-level authorization in the Update Many API for Postgres backends. The fixed versions are 2.10.2, 2.11.3, 2.12.1, 2.13.2, 2.14.1, and 2.15.2. (Versions before 2.10.0 are unaffected.)","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00879,"percentile":0.59349,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-732","CWE-863"],"published":"2022-12-08T00:00:00Z","modified":"2026-10-28T02:30:50Z","products":[{"vendor":"hasura","product":"graphql_engine"}],"references":[{"url":"https://groups.google.com/g/hasura-security-announce/c/kzK-uPAKGUU","tags":["x_transferred","Mailing List","Patch","Third Party Advisory","web"]},{"url":"https://hasura.io/blog/critical-vulnerability-in-hasuras-graphql-engine-v2-10-0/","tags":["x_transferred","Mitigation","Vendor Advisory","article"]},{"url":"https://github.com/hasura/graphql-engine/security/advisories/GHSA-g7mj-g7f4-hgrg","tags":["x_transferred","Patch","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-46792","tags":["advisory"]},{"url":"https://hasura.io/blog/critical-vulnerability-in-hasuras-graphql-engine-v2-10-0"},{"url":"https://github.com/advisories/GHSA-jfv6-7jf3-3v86"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/46xxx/CVE-2022-46792.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-46792","description":"Hasura GraphQL Engine before 2.15.2 mishandles row-level authorization in the Update Many API for Postgres backends. The fixed versions are 2.10.2, 2.11.3, 2.12.1, 2.13.2, 2.14.1, and 2.15.2. (Versions before 2.10.0 are unaffected.)","status":"published","published":"2022-12-08T00:00:00Z","modified":"2025-04-23T14:25:42.452Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:34:31.840191Z"}],"euvd":[{"id":"EUVD-2022-49574","description":"Hasura GraphQL Engine before 2.15.2 mishandles row-level authorization in the Update Many API for Postgres backends. The fixed versions are 2.10.2, 2.11.3, 2.12.1, 2.13.2, 2.14.1, and 2.15.2. (Versions before 2.10.0 are unaffected.)","status":"published","published":"2022-12-08T00:00:00Z","modified":"2025-04-23T14:25:42Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:52:14.077439Z"}],"ghsa":[{"id":"GHSA-jfv6-7jf3-3v86","title":"Hasura GraphQL Engine before 2.15.2 mishandles row-level authorization in the Update Many API for...","description":"Hasura GraphQL Engine before 2.15.2 mishandles row-level authorization in the Update Many API for Postgres backends. The fixed versions are 2.10.2, 2.11.3, 2.12.1, 2.13.2, 2.14.1, and 2.15.2. (Versions before 2.10.0 are unaffected.)","status":"published","published":"2022-12-08T06:30:29Z","modified":"2025-04-23T15:30:38Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-732","CWE-863"],"updated_at":"2026-11-02T15:02:00.180386Z"}],"nvd":[{"id":"CVE-2022-46792","description":"Hasura GraphQL Engine before 2.15.2 mishandles row-level authorization in the Update Many API for Postgres backends. The fixed versions are 2.10.2, 2.11.3, 2.12.1, 2.13.2, 2.14.1, and 2.15.2. (Versions before 2.10.0 are unaffected.)","status":"published","published":"2022-12-08T06:15:08.94Z","modified":"2026-06-17T05:12:23.323Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:07:33.239526Z"}],"osv":[{"id":"CVE-2022-46792","description":"Hasura GraphQL Engine before 2.15.2 mishandles row-level authorization in the Update Many API for Postgres backends. The fixed versions are 2.10.2, 2.11.3, 2.12.1, 2.13.2, 2.14.1, and 2.15.2. (Versions before 2.10.0 are unaffected.)","status":"published","published":"2022-12-08T00:00:00Z","modified":"2026-10-28T02:30:50.628060373Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:27.481647Z"}]}}