CVE-2026-62247

Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to 2.111.2, Realtime authorization does not correctly honor the per-extension presence.read row-level security policy when a private-channel client is allowed presence.write but explicitly denied...

EUVD-2026-84066

Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to 2.111.2, Realtime authorization does not correctly honor the per-extension presence.read row-level security policy when a private-channel client is allowed presence.write but explicitly denied...

CVE-2026-62247

Supabase Realtime (prior to 2.111.2 ) contains an incorrect authorization flaw in its per-extension presence.read row-level security (RLS) policy enforcement. When a private-channel client is granted presence.write but explicitly denied presence.read , the client can still receive presence_diff m...

CVE-2026-62247 Supabase Realtime: Incorrect Authorization

Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to 2.111.2, Realtime authorization does not correctly honor the per-extension presence.read row-level security policy when a private-channel client is allowed presence.write but explicitly denied...

CVE-2026-62247 Supabase Realtime: Incorrect Authorization

Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to 2.111.2, Realtime authorization does not correctly honor the per-extension presence.read row-level security policy when a private-channel client is allowed presence.write but explicitly denied...

CVE-2026-62247 Supabase Realtime: Incorrect Authorization

Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to 2.111.2, Realtime authorization does not correctly honor the per-extension presence.read row-level security policy when a private-channel client is allowed presence.write but explicitly denied...

CVE-2026-62247: Incorrect Authorization

Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to 2.111.2, Realtime authorization does not correctly honor the per-extension presence.read row-level security policy when a private-channel client is allowed presence.write but explicitly denied...

PT-2026-96235

Name of the Vulnerable Software and Affected Versions Supabase Realtime versions prior to 2.111.2 Description Realtime authorization fails to correctly honor the per-extension presence.read row-level security policy. This occurs when a private-channel client is granted presence.write permissions...