CVE-2026-62247: Supabase Realtime: Incorrect Authorization
Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to 2.111.2, Realtime authorization does not correctly honor the per-extension presence.read row-level security policy when a private-channel client is allowed presence.write but explicitly denied presence.read. Under that differential policy, the client can receive presencediff messages containing other members' presence metadata, including application-defined location, online-status, roster, viewing, or typing information. Deployments with uniform presence visibility have no differential, and postgreschanges row data is unaffected. This issue is fixed in version 2.111.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Supabase Realtimeto a version that resolves this vulnerability.Fixed in 2.111.2
Event History
Frequently Asked Questions
Which deployments are exposed to unauthorized presence metadata disclosure?
Affected deployments use private channels and have a differential per-extension policy that allows a client presence.write while explicitly denying presence.read. Deployments with uniform presence visibility do not have this differential exposure.
What must an attacker be able to do to exploit this issue?
The attacker needs credentials or other access sufficient to connect as a client to the relevant private channel with presence.write permission. No user interaction is required.
What information can be disclosed, and is Postgres Changes data included?
An affected client can receive presence_diff messages containing other members' presence metadata, such as application-defined location, online status, roster, viewing, or typing information. Postgres Changes row data is not affected.
How can this be remediated?
Upgrade Supabase Realtime to version 2.111.2 or later. If upgrading is not immediately possible, avoid policies that grant presence.write while explicitly denying presence.read on the same private channel.