CVE-2026-62247

MediumCVSS 6.5

Published: 21/09/2026(UTC)Updated: 24/09/2026(UTC)Translated: 22/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.45%

37th percentile - higher than 37% of all known CVEs

Summary

Supabase Realtime before version 2.111.2 has a vulnerability in authorization that does not correctly honor the per-extension presence.read row-level security policy when a private-channel client is allowed presence.write but explicitly denied presence.read. Under that differential policy, the client can receive presence_diff messages containing other members' presence metadata, including application-defined location, online-status, roster, viewing, or typing information. Deployments with uniform presence visibility have no differential, and postgres_changes row data is unaffected. This issue is fixed in version 2.111.2.

Risk Assessment

The organization may experience unauthorized disclosure of user presence metadata, violating privacy and potentially enabling activity tracking.

Recommendation

Upgrade Supabase Realtime to version 2.111.2 or later to fix the vulnerability. Review presence RLS policies to ensure consistency.

Other vulnerabilities in Supabase Realtime

CVE-2026-54238Low
Supabase Realtime prior to version 2.103.1 accepts an expired JWT on REST broadcast endpoints when the exp claim is encoded as a JSON string instead of a number. This allows an unauthenticated attacker to broadcast realtime messages to subscribers.

Original NVD description (English source)

Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to 2.111.2, Realtime authorization does not correctly honor the per-extension presence.read row-level security policy when a private-channel client is allowed presence.write but explicitly denied presence.read. Under that differential policy, the client can receive presence_diff messages containing other members' presence metadata, including application-defined location, online-status, roster, viewing, or typing information. Deployments with uniform presence visibility have no differential, and postgres_changes row data is unaffected. This issue is fixed in version 2.111.2.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS