Medium
Supabase Realtime: Incorrect Authorization
Type: advisorySources: OSV
Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to 2.111.2, Realtime authorization does not correctly honor the per-extension presence.read row-level security policy when a private-channel client is allowed presence.write but explicitly denied presence.read. Under that differential policy, the client can receive presence_diff messages containing other members' presence metadata, including application-defined location, online-status, roster, viewing, or typing information. Deployments with uniform presence visibility have no differential, and postgres_changes row data is unaffected. This issue is fixed in version 2.111.2.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-62247
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 17:18 UTC · Revision 1
Source evidence
Supabase Realtime: Incorrect Authorization
core-osv · Original sourcePublished 21 Sept 2026, 19:04 UTC
Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to 2.111.2, Realtime authorization does not correctly honor the per-extension presence.read row-level security policy when a private-channel client is allowed presence.write but explicitly denied presence.read. Under that differential policy, the client can receive presence_diff messages containing other members' presence metadata, including application-defined location, online-status, roster, viewing, or typing information. Deployments with uniform presence visibility have no differential, and postgres_changes row data is unaffected. This issue is fixed in version 2.111.2.
osv:CVE-2026-62247
Complete source record
{
"id": "3e69e5499c17fba3d189d580965c23b352a35e756b66a456d62fb7e70271957d",
"url": "https://osv.dev/vulnerability/CVE-2026-62247",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Supabase Realtime: Incorrect Authorization",
"summary": "Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to 2.111.2, Realtime authorization does not correctly honor the per-extension presence.read row-level security policy when a private-channel client is allowed presence.write but explicitly denied presence.read. Under that differential policy, the client can receive presence_diff messages containing other members' presence metadata, including application-defined location, online-status, roster, viewing, or typing information. Deployments with uniform presence visibility have no differential, and postgres_changes row data is unaffected. This issue is fixed in version 2.111.2.",
"evidence": "osv:CVE-2026-62247",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2026-62247",
"aliases": [
"CVE-2026-62247",
"GHSA-rcr8-2525-4r7p"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/supabase/realtime",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "631e075c2f3b38129bb550a901bc31369e221baf"
},
{
"fixed": "c039bca9b57c2e554a67fdf462970b54641d82eb"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "2.111.2"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"fixed": "c039bca9b57c2e554a67fdf462970b54641d82eb"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "631e075c2f3b38129bb550a901bc31369e221baf"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v2.111.2"
}
]
}
}
],
"versions": [
"v2.111.1",
"v2.111.0",
"v2.110.0",
"v2.109.1",
"v2.109.0",
"v2.108.0",
"v2.107.5",
"v2.107.4",
"v2.107.3",
"v2.107.2",
"v2.107.1",
"v2.107.0",
"v2.106.0",
"v2.105.2",
"v2.105.1",
"v2.105.0",
"v2.104.2",
"v2.104.1",
"v2.104.0",
"v2.103.4",
"v2.103.3",
"v2.103.2",
"v2.103.1",
"v2.103.0",
"v2.102.3",
"v2.102.2",
"v2.102.1",
"v2.102.0",
"v2.101.0",
"v2.100.0",
"v2.99.0",
"v2.98.4",
"v2.98.3",
"v2.98.2",
"v2.98.1",
"v2.98.0",
"v2.97.3",
"v2.97.2",
"v2.97.1",
"v2.97.0",
"v2.96.2",
"v2.96.3",
"v2.96.1",
"v2.96.0",
"v2.95.0",
"v2.94.3",
"v2.94.2",
"v2.94.1",
"v2.94.0",
"v2.93.5",
"v2.93.4",
"v2.93.3",
"v2.93.2",
"v2.93.1",
"v2.93.0",
"v2.92.2",
"v2.92.1",
"v2.92.0",
"v2.91.0",
"v2.90.1",
"v2.90.0",
"v2.89.3",
"v2.89.2",
"v2.89.1",
"v2.89.0",
"v2.88.2",
"v2.88.1",
"v2.88.0",
"v2.87.0",
"v2.86.3",
"v2.86.2",
"v2.86.0",
"v2.86.1",
"v2.85.2",
"v2.85.1",
"v2.85.0",
"v2.84.0",
"v2.83.3",
"v2.83.2",
"v2.82.1",
"v2.83.1",
"v2.83.0",
"v2.82.0",
"v2.81.1",
"v2.81.0",
"v2.80.13",
"v2.80.12",
"v2.80.11",
"v2.80.10",
"v2.80.9",
"v2.80.8",
"v2.80.7",
"v2.80.6",
"v2.80.5",
"v2.80.4",
"v2.80.3",
"v2.80.2",
"v2.80.1",
"v2.80.0",
"v2.79.0",
"v2.78.19",
"v2.78.18",
"v2.78.17",
"v2.78.16",
"v2.78.15",
"v2.78.14",
"v2.78.13",
"v2.78.12",
"v2.78.11",
"v2.78.10",
"v2.78.9",
"v2.78.8",
"v2.78.7",
"v2.78.6",
"v2.78.5",
"v2.78.4",
"v2.78.3",
"v2.78.2",
"v2.78.1",
"v2.78.0",
"v2.77.0",
"v2.76.7",
"v2.76.6",
"v2.76.5",
"v2.76.4",
"v2.76.3",
"v2.76.2",
"v2.76.1",
"v2.76.0",
"v2.75.2",
"v2.75.1",
"v2.75.0",
"v2.74.9",
"v2.74.8",
"v2.74.7",
"v2.74.6",
"v2.74.5",
"v2.74.4",
"v2.74.3",
"v2.74.2",
"v2.74.1",
"v2.74.0",
"v2.73.7",
"v2.73.6",
"v2.73.5",
"v2.73.4",
"v2.73.3",
"v2.73.2",
"v2.73.1",
"v2.73.0",
"v2.72.0",
"v2.71.5",
"v2.71.4",
"v2.71.3",
"v2.71.2",
"v2.71.1",
"v2.71.0",
"v2.70.0",
"v2.69.2",
"v2.69.1",
"v2.69.0",
"v2.68.7",
"v2.68.6",
"v2.68.5",
"v2.68.4",
"v2.68.3",
"v2.68.2",
"v2.68.1",
"v2.68.0",
"v2.67.8",
"v2.67.7",
"v2.67.6",
"v2.67.5",
"v2.67.4",
"v2.67.3",
"v2.67.2",
"v2.67.1",
"v2.67.0",
"v2.66.4",
"v2.66.3",
"v2.66.2",
"v2.66.1",
"v2.66.0",
"v2.65.3",
"v2.65.2",
"v2.65.1",
"v2.65.0",
"v2.64.0",
"v2.63.3",
"v2.63.2",
"v2.63.1",
"v2.63.0",
"v2.62.0",
"v2.61.1",
"v2.61.0",
"v2.60.0",
"v2.59.1",
"v2.59.0",
"v2.58.2",
"v2.58.1",
"v2.58.0",
"v2.57.6",
"v2.57.5",
"v2.57.4",
"v2.57.3",
"v2.57.2",
"v2.57.1",
"v2.57.0",
"v2.56.5",
"v2.56.4",
"v2.56.3",
"v2.56.2",
"v2.56.1",
"v2.56.0",
"v2.55.2",
"v2.55.1",
"v2.55.0",
"v2.54.4",
"v2.54.3",
"v2.54.2",
"v2.54.1",
"v2.54.0",
"v2.53.4",
"v2.53.3",
"v2.53.2",
"v2.53.1",
"v2.53.0",
"v2.52.1",
"v2.52.0",
"v2.51.15",
"v2.51.14",
"v2.51.13",
"v2.51.12",
"v2.51.11",
"v2.51.10",
"v2.51.9",
"v2.51.8",
"v2.51.7",
"v2.51.6",
"v2.51.5",
"v2.51.4",
"v2.51.3",
"v2.51.2",
"v2.51.1",
"v2.51.0",
"v2.50.2",
"v2.47.4",
"v2.48.2",
"v2.50.1",
"v2.50.0",
"v2.49.0",
"v2.48.1",
"v2.48.0",
"v2.47.3",
"v2.47.2",
"v2.47.1",
"v2.47.0",
"v2.46.4",
"v2.46.3",
"v2.46.2",
"v2.46.1",
"v2.46.0",
"v2.45.0",
"v2.44.0",
"v2.43.2",
"v2.43.1",
"v2.43.0",
"v2.42.6",
"v2.42.5",
"v2.42.4",
"v2.42.3",
"v2.42.2",
"v2.42.1",
"v2.42.0",
"v2.41.25",
"v2.41.24",
"v2.41.23",
"v2.41.22",
"v2.41.21",
"v2.41.20",
"v2.41.19",
"v2.41.18",
"v2.41.17",
"v2.41.16",
"v2.41.15",
"v2.41.14",
"v2.41.13",
"v2.41.12",
"v2.41.11",
"v2.41.10",
"v2.41.9",
"v2.41.8",
"v2.41.7",
"v2.41.6",
"v2.41.5",
"v2.41.4",
"v2.41.3",
"v2.41.2",
"v2.40.11",
"v2.41.1",
"v2.41.0",
"v2.40.10",
"v2.40.9",
"v2.40.8",
"v2.40.7",
"v2.40.6",
"v2.40.5",
"v2.40.4",
"v2.40.3",
"v2.40.2",
"v2.40.1",
"v2.40.0",
"v2.39.6",
"v2.39.5",
"v2.39.4",
"v2.39.3",
"v2.39.2",
"v2.39.1",
"v2.39.0",
"v2.38.0",
"v2.37.11",
"v2.37.10",
"v2.37.9",
"v2.37.8",
"v2.37.7",
"v2.37.6",
"v2.37.5",
"v2.37.4",
"v2.37.3",
"v2.37.2",
"v2.37.1",
"v2.37.0",
"v2.36.21",
"v2.36.20",
"v2.36.19",
"v2.36.18",
"v2.36.17",
"v2.36.16",
"v2.36.15",
"v2.36.14",
"v2.36.13",
"v2.36.12",
"v2.36.11",
"v2.36.10",
"v2.36.9",
"v2.36.8",
"v2.36.7",
"v2.36.6",
"v2.36.5",
"v2.36.4",
"v2.36.3",
"v2.36.2",
"v2.36.1",
"v2.36.0",
"v2.35.8",
"v2.35.7",
"v2.35.6",
"v2.35.5",
"v2.35.4",
"v2.35.3",
"v2.35.2",
"v2.35.1",
"v2.35.0",
"v2.34.55",
"v2.34.54",
"v2.34.53",
"v2.34.52",
"v2.34.51",
"v2.34.50",
"v2.34.49",
"v2.34.48",
"v2.34.47",
"v2.34.46",
"v2.34.45",
"v2.34.44",
"v2.34.43",
"v2.34.42",
"v2.34.41",
"v2.34.40",
"v2.34.39",
"v2.34.38",
"v2.34.37",
"v2.34.36",
"v2.34.35",
"v2.34.34",
"v2.34.33",
"v2.34.32",
"v2.34.31",
"v2.34.30",
"v2.34.29",
"v2.34.28",
"v2.34.27",
"v2.34.26",
"v2.34.25",
"v2.34.24",
"v2.34.23",
"v2.34.22",
"v2.34.21",
"v2.34.20",
"v2.34.19",
"v2.34.18",
"v2.34.17",
"v2.34.16",
"v2.34.15",
"v2.34.14",
"v2.34.13",
"v2.34.12",
"v2.34.11",
"v2.34.10",
"v2.34.9",
"v2.34.8",
"v2.34.7",
"v2.34.6",
"v2.34.5",
"v2.34.4",
"v2.34.3",
"v2.34.2",
"v2.34.1",
"v2.34.0",
"v2.33.84",
"v2.33.83",
"v2.33.82",
"v2.33.81",
"v2.33.80",
"v2.33.79",
"v2.33.78",
"v2.33.77",
"v2.33.76",
"v2.33.75",
"v2.33.74",
"v2.33.73",
"v2.33.72",
"v2.33.71",
"v2.33.70",
"v2.33.69",
"v2.33.68",
"v2.33.67",
"v2.33.66",
"v2.33.65",
"v2.33.64",
"v2.33.63",
"v2.33.62",
"v2.33.61",
"v2.33.60",
"v2.33.59",
"v2.33.58",
"v2.33.57",
"v2.33.56",
"v2.33.55",
"v2.33.54",
"v2.33.53",
"v2.33.52",
"v2.33.51",
"v2.33.50",
"v2.33.49",
"v2.33.48",
"v2.33.47",
"v2.33.46",
"v2.33.45",
"v2.33.44",
"v2.33.43",
"v2.33.42",
"v2.33.41",
"v2.33.40",
"v2.33.39",
"v2.33.38",
"v2.33.37",
"v2.33.36",
"v2.33.35",
"v2.33.34",
"v2.33.33",
"v2.33.32",
"v2.33.31",
"v2.33.30",
"v2.33.29",
"v2.33.28",
"v2.33.27",
"v2.33.26",
"v2.33.25",
"v2.33.24",
"v2.33.23",
"v2.33.22",
"v2.33.21",
"v2.33.20",
"v2.33.19",
"v2.33.18",
"v2.33.17",
"v2.33.16",
"v2.33.15",
"v2.33.14",
"v2.33.13",
"v2.33.12",
"v2.33.11",
"v2.33.10",
"v2.33.9",
"v2.33.8",
"v2.33.7",
"v2.33.6",
"v2.33.5",
"v2.33.4",
"v2.33.3",
"v2.33.2",
"v2.33.1",
"v2.33.0",
"v2.32.12",
"v2.32.11",
"v2.32.10",
"v2.32.9",
"v2.32.8",
"v2.32.7",
"v2.32.6",
"v2.32.5",
"v2.32.4",
"v2.32.3",
"v2.32.2",
"v2.32.1",
"v2.32.0",
"v2.31.0",
"v2.30.34",
"v2.30.33",
"v2.30.32",
"v2.30.31",
"v2.30.30",
"v2.30.29",
"v2.30.28",
"v2.30.27",
"v2.30.26",
"v2.30.25",
"v2.30.24",
"v2.30.23",
"v2.30.22",
"v2.30.21",
"v2.30.20",
"v2.30.19",
"v2.30.18",
"v2.30.17",
"v2.30.16",
"v2.30.15",
"v2.30.14",
"v2.30.13",
"v2.30.12",
"v2.30.11",
"v2.30.10",
"v2.30.9",
"v2.30.8",
"v2.30.7",
"v2.30.6",
"v2.30.5",
"v2.30.4",
"v2.30.3",
"v2.30.2",
"v2.30.1",
"v2.30.0",
"v2.29.17",
"v2.29.16",
"v2.29.15",
"v2.29.14",
"v2.29.13",
"v2.29.12",
"v2.29.11",
"v2.29.10",
"v2.29.9",
"v2.29.8",
"v2.29.7",
"v2.29.6",
"v2.29.5",
"v2.29.4",
"v2.29.3",
"v2.29.2",
"v2.29.1",
"v2.29.0",
"v2.28.40",
"v2.28.39",
"v2.28.38",
"v2.28.37",
"v2.28.36",
"v2.28.35",
"v2.28.34",
"v2.28.33",
"v2.28.32",
"v2.28.31",
"v2.28.30",
"v2.28.29",
"v2.28.28",
"v2.28.27",
"v2.28.26",
"v2.28.25",
"v2.28.24",
"v2.28.23",
"v2.28.22",
"v2.28.21",
"v2.28.20",
"v2.28.19",
"v2.28.18",
"v2.28.17",
"v2.28.16",
"v2.28.15",
"v2.28.14",
"v2.28.13",
"v2.28.12",
"v2.28.11",
"v2.28.10",
"v2.28.9",
"v2.28.8",
"v2.28.7",
"v2.28.6",
"v2.28.5",
"v2.28.4",
"v2.28.3",
"v2.28.2",
"v2.28.1",
"v2.28.0",
"v2.27.7",
"v2.27.6",
"v2.27.5",
"v2.27.4",
"v2.27.3",
"v2.27.2",
"v2.27.1",
"v2.27.0",
"v2.26.8",
"v2.26.7",
"v2.26.6",
"v2.26.5",
"v2.26.4",
"v2.26.3",
"v2.26.2",
"v2.26.1",
"v2.26.0",
"v2.25.70",
"v2.25.69",
"v2.25.68",
"v2.25.67",
"v2.25.66",
"v2.25.65",
"v2.25.64",
"v2.25.63",
"v2.25.62",
"v2.25.61",
"v2.25.60",
"v2.25.59",
"v2.25.58",
"v2.25.57",
"v2.25.56",
"v2.25.55",
"v2.25.54",
"v2.25.53",
"v2.25.52",
"v2.25.51",
"v2.25.50",
"v2.25.49",
"v2.25.48",
"v2.25.47",
"v2.25.46",
"v2.25.45",
"v2.25.44",
"v2.25.43",
"v2.25.42",
"v2.25.41",
"v2.25.40",
"v2.25.39",
"v2.25.38",
"v2.25.37",
"v2.25.36",
"v2.25.35",
"v2.25.34",
"v2.25.33",
"v2.25.32",
"v2.25.31",
"v2.25.30",
"v2.25.29",
"v2.25.28",
"v2.25.27",
"v2.25.26",
"v2.25.25",
"v2.25.24",
"v2.25.23",
"v2.25.22",
"v2.25.21",
"v2.25.20",
"v2.25.19",
"v2.25.18",
"v2.25.17",
"v2.25.16",
"v2.25.15",
"v2.25.14",
"v2.25.13",
"v2.25.12",
"v2.25.11",
"v2.25.10",
"v2.25.9",
"v2.25.8",
"v2.25.7",
"v2.25.6",
"v2.25.5",
"v2.25.4",
"v2.25.3",
"v2.25.2",
"v2.25.1",
"v2.25.0",
"v2.24.2",
"v2.24.1",
"v2.24.0",
"v2.23.3",
"v2.23.2",
"v2.23.1",
"v2.23.0",
"v2.22.29",
"v2.22.28",
"v2.22.27",
"v2.22.26",
"v2.22.25",
"v2.22.24",
"v2.22.23",
"v2.22.22",
"v2.22.21",
"v2.22.20",
"v2.22.19",
"v2.22.18",
"v2.22.17",
"v2.22.16",
"v2.22.15",
"v2.22.14",
"v2.22.13",
"v2.22.12",
"v2.22.11",
"v2.22.10",
"v2.22.9",
"v2.22.8",
"v2.22.7",
"v2.22.6",
"v2.22.5",
"v2.22.4",
"v2.22.3",
"v2.22.2",
"v2.22.1",
"v2.22.0",
"v2.21.1",
"v2.21.0",
"v2.20.4",
"v2.20.3",
"v2.20.2",
"v2.20.1",
"v2.20.0",
"v2.19.5",
"v2.19.4",
"v2.19.3",
"v2.19.2",
"v2.19.1",
"v2.19.0",
"v2.18.1",
"v2.18.0",
"v2.17.2",
"v2.17.1",
"v2.17.0",
"v2.16.0",
"v2.15.0",
"v2.14.0",
"v2.13.2",
"v2.13.1",
"v2.13.0",
"v2.12.7",
"v2.12.6",
"v2.12.5",
"v2.12.4",
"v2.12.3",
"v2.12.2",
"v2.12.1",
"v2.12.0",
"v2.11.0",
"v2.10.1",
"v2.10.0",
"v2.9.3",
"v2.9.2",
"v2.9.1",
"v2.9.0",
"v2.8.2",
"v2.8.1",
"v2.8.0",
"v2.7.0",
"v2.6.0",
"v2.1.0",
"v2.0.3",
"v2.0.2",
"v2.0.1",
"v2.0.0",
"v1.0.0",
"v0.25.1",
"v0.25.0",
"v0.24.2",
"v0.24.1",
"v0.24.0",
"v0.23.0",
"v0.22.7",
"v0.22.6",
"v0.22.5",
"v0.22.4",
"v0.22.3",
"v0.22.2",
"v0.22.1",
"v0.22.0",
"v0.21.0",
"v0.20.4",
"v0.20.3",
"v0.20.2",
"v0.20.1",
"v0.20.0",
"v0.19.5",
"v0.19.4",
"v0.19.3",
"v0.19.2",
"v0.19.1",
"v0.19.0",
"v0.18.1",
"v0.18.0",
"v0.17.2",
"v0.17.1",
"v0.17.0",
"v0.16.0",
"v0.15.0",
"v0.14.4",
"v0.14.3",
"v0.14.2",
"v0.14.1",
"v0.14.0",
"v0.13.3",
"v0.13.2",
"v0.13.1",
"v0.13.0",
"v0.12.0",
"v0.11.1",
"v0.11.0",
"v0.10.6",
"v0.10.5",
"v0.10.4",
"v0.10.3",
"v0.10.2",
"v0.10.1",
"v0.10.0",
"v0.9.7",
"v0.9.6",
"v0.9.5",
"v0.9.4",
"v0.9.3",
"v0.9.2",
"v0.9.1",
"v0.9.0",
"v0.8.0",
"v0.7.11",
"v0.7.10",
"v0.7.9",
"v0.7.8",
"v0.7.7",
"0.7.5",
"0.7.4",
"0.7.3",
"0.7.0",
"push",
"0.6.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-62247.json"
}
}
],
"modified": "2026-10-28T02:30:37.715071810Z",
"provider": "osv",
"references": [
"https://github.com/supabase/realtime/releases/tag/v2.111.2",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/62xxx/CVE-2026-62247.json",
"https://github.com/supabase/realtime/security/advisories/GHSA-rcr8-2525-4r7p",
"https://nvd.nist.gov/vuln/detail/CVE-2026-62247",
"https://github.com/supabase/realtime/commit/c039bca9b57c2e554a67fdf462970b54641d82eb",
"https://github.com/supabase/realtime/pull/1969"
],
"provider_metadata": {
"cwe_ids": [
"CWE-863"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/62xxx/CVE-2026-62247.json"
}
},
"related_cves": [
{
"value": "CVE-2026-62247",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 505261,
"published_at": "2026-09-21T19:04:58.743+00:00"
}