CVE-2026-62247

Name of the Vulnerable Software and Affected Versions Supabase Realtime versions prior to 2.111.2

Description Realtime authorization fails to correctly honor the per-extension presence.read row-level security policy. This occurs when a private-channel client is granted presence.write permissions but is explicitly denied presence.read permissions. In this scenario, the client can receive presence diff messages containing metadata of other members, such as application-defined location, online-status, roster, viewing, or typing information. This issue does not affect deployments with uniform presence visibility or postgres changes row data.

Recommendations Update to version 2.111.2.