Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to 2.111.2, Realtime authorization does not correctly honor the per-extension presence.read row-level security policy when a private-channel client is allowed presence.write but explicitly denied presence.read. Under that differential policy, the client can receive presence_diff messages containing other members' presence metadata, including application-defined location, online-status, roster, viewing, or typing information.
Deployments with uniform presence visibility have no differential, and postgres_changes row data is unaffected. This issue is fixed in version 2.111.2.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
None
No data modification
Availability
None
No disruption
CVSS Vector v3.1
Weakness Type (CWE)
Vulnerable Products
supabase:realtime
References 4
https://github.com/supabase/realtime/security/advisories/GHSA-rcr8-2525-4r7p
https://github.com/supabase/realtime/security/advisories/GHSA-rcr8-2525-4r7p
https://github.com/supabase/realtime/pull/1969
https://github.com/supabase/realtime/pull/1969
https://github.com/supabase/realtime/commit/c039bca9b57c2e554a67fdf462970b54641…
https://github.com/supabase/realtime/commit/c039bca9b57c2e554a67fdf462970b54641d82eb
https://github.com/supabase/realtime/releases/tag/v2.111.2
https://github.com/supabase/realtime/releases/tag/v2.111.2