CVE-2026-62247

MEDIUM 6.5

Supabase Realtime: Incorrect Authorization

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to 2.111.2, Realtime authorization does not correctly honor the per-extension presence.read row-level security policy when a private-channel client is allowed presence.write but explicitly denied presence.read. Under that differential policy, the client can receive presence_diff messages containing other members' presence metadata, including application-defined location, online-status, roster, viewing, or typing information. Deployments with uniform presence visibility have no differential, and postgres_changes row data is unaffected. This issue is fixed in version 2.111.2.

CWE	CWE-863
Vendor	supabase
Product	realtime
Published	Sep 21, 2026

Stay Ahead of the Next One

Get instant alerts for supabase realtime

Be the first to know when new medium vulnerabilities affecting supabase realtime are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

supabase / realtime

< 2.111.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/supabase/realtime/security/advisories/GHSA-rcr8-2525-4r7p github.com: https://github.com/supabase/realtime/pull/1969 github.com: https://github.com/supabase/realtime/commit/c039bca9b57c2e554a67fdf462970b54641d82eb github.com: https://github.com/supabase/realtime/releases/tag/v2.111.2