{"id":"CVE-2023-35167","aliases":["GHSA-7hh3-3x64-v2g9"],"url":"https://o3.security/vulnerability/CVE-2023-35167","summary":"When setting EntityOptions.apiPrefilter to a function, the filter is not applied to API requests for a resource by Id","details":"Remult is a CRUD framework for full-stack TypeScript. If you used the apiPrefilter option of the `@Entity` decorator, by setting it to a function that returns a filter that prevents unauthorized access to data, an attacker who knows the `id` of an entity instance is not authorized to access, can gain read, update and delete access to it. The issue is fixed in version 0.20.6. As a workaround, set the `apiPrefilter` option to a filter object instead of a function.","published":"2023-06-23T19:03:54.753Z","modified":"2026-07-15T01:49:06.719839388Z","cvss":{"score":5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"remult","fixedVersion":"0.20.6"}],"fix":{"url":"https://github.com/remult/remult/commit/6892ae97134126d8710ef7302bb2fc37730994c5","label":"remult/remult@6892ae9"},"references":[{"type":"WEB","url":"https://github.com/remult/remult/releases/tag/v0.20.6"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/35xxx/CVE-2023-35167.json"},{"type":"ADVISORY","url":"https://github.com/remult/remult/security/advisories/GHSA-7hh3-3x64-v2g9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-35167"},{"type":"FIX","url":"https://github.com/remult/remult/commit/6892ae97134126d8710ef7302bb2fc37730994c5"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-15T01:49:06.719839388Z"}}