CVE-2026-62247 Details
Description
Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to 2.111.2, Realtime authorization does not correctly honor the per-extension presence.read row-level security policy when a private-channel client is allowed presence.write but explicitly denied presence.read. Under that differential policy, the client can receive presence_diff messages containing other members' presence metadata, including application-defined location, online-status, roster, viewing, or typing information. Deployments with uniform presence visibility have no differential, and postgres_changes row data is unaffected. This issue is fixed in version 2.111.2.
A vulnerability in Supabase Realtime versions prior to 2.111.2 allows for improper handling of presence authorization. Specifically, clients with permission to write presence data but denied the right to read it can still receive 'presence_diff' messages. These messages contain metadata about other members' presence, such as location, online status, and typing information. This issue arises in private channels where the presence visibility is more restrictive than the broadcast visibility, creating a scenario where sensitive presence data can be inadvertently shared with unauthorized clients.
Update Supabase Realtime to version 2.111.2 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 21, 2026CISA-ADP
Assessed Sep 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/supabase/realtime/commit/c039bca9b57c2e554a67fdf462970b54641d82eb | [email protected] | Source CodeVendor |
| https://github.com/supabase/realtime/pull/1969 | [email protected] | Issue TrackingVendor |
| https://github.com/supabase/realtime/releases/tag/v2.111.2 | [email protected] | Release NotesVendor |
| https://github.com/supabase/realtime/security/advisories/GHSA-rcr8-2525-4r7p | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Supabase Realtime | <= 2.111.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 22, 2026 | CVE Modified | CISA-ADP |
| Sep 21, 2026 | New CVE Received | [email protected] |