CVE-2026-62247

Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to 2.111.2, Realtime authorization does not correctly honor the per-extension presence.read row-level security policy when a private-channel client is allowed presence.write but explicitly denied presence.read. Under that differential policy, the client can receive presence_diff messages containing other members' presence metadata, including application-defined location, online-status, roster, viewing, or typing information. Deployments with uniform presence visibility have no differential, and postgres_changes row data is unaffected. This issue is fixed in version 2.111.2.

• CWE-863

• https://github.com/supabase/realtime/commit/c039bca9b57c2e554a67fdf462970b54641d82eb
• https://github.com/supabase/realtime/pull/1969
• https://github.com/supabase/realtime/releases/tag/v2.111.2
• https://github.com/supabase/realtime/security/advisories/GHSA-rcr8-2525-4r7p

Published

Sep 21, 2026

Last Modified

Sep 24, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-6224A security flaw has been discovered in nocobase plugin-workf…7.3
• CVE-2026-62240CrewAI before 1.15.1 contains a server-side request forgery …7.4
• CVE-2026-62241clawvet self-hosted API server (apps/api) before 0.7.5 hard-…9.3
• CVE-2026-62242Spring Boot Admin Server before 4.1.2 contains a server-side…8.6
• CVE-2026-62243Netty (io.netty:netty-handler) versions from 4.2.0.Final thr…7.5
• CVE-2026-62246Kamaji is the Hosted Control Plane Manager for Kubernetes. P…8.5
• CVE-2026-62248Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-62249Weblate is a web-based continuous localization platform used…4.3
• CVE-2026-6225The Taskbuilder – Project Management & Task Management Tool …6.5
• CVE-2026-6226The Frontend Admin by DynamiApps plugin for WordPress is vul…8.8
• CVE-2026-62262Piwigo is a full featured open source photo gallery applicat…9.1
• CVE-2026-62263Open Access Management (OpenAM) is an access management solu…9.2