CVE-2022-46792

HIGH 8.8CVE-2022-46792 · Published 08/12/2022 · updated 17/06/2026

In short

CVE-2022-46792 is a HIGH (CVSS 8.8) vulnerability affecting graphql engine (hasura).
Chance of exploitation in the next 30 days (EPSS): 0.88%, higher than 59.1% of all vulnerabilities.
Fix: update to 2.10.2, 2.11.3, 2.13.2, 2.15.2 or later.

Package	Affected versions	Patched versions
graphql engine hasura	`= 2.12.0= 2.14.0≥ 2.10.0, < 2.10.2≥ 2.11.0, < 2.11.3≥ 2.13.0, < 2.13.2≥ 2.15.0, < 2.15.2`	`2.10.22.11.32.13.22.15.2`

Description

Hasura GraphQL Engine before 2.15.2 mishandles row-level authorization in the Update Many API for Postgres backends. The fixed versions are 2.10.2, 2.11.3, 2.12.1, 2.13.2, 2.14.1, and 2.15.2. (Versions before 2.10.0 are unaffected.)

References

hasura/graphql-engine security advisory · Patch
groups.google.com/g/hasura-security-announce/c/kzK-uPAKGUU · Mailing List
hasura.io/blog/critical-vulnerability-in-hasuras-graphql-engine-v2-10-0 · Mitigation

More vulnerabilities in graphql engine

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

graphql engine

hasura

= 2.12.0= 2.14.0≥ 2.10.0, < 2.10.2≥ 2.11.0, < 2.11.3≥ 2.13.0, < 2.13.2≥ 2.15.0, < 2.15.2

2.10.22.11.32.13.22.15.2

More vulnerabilities in graphql engine

See all →