{"id":"CVE-2026-62247","title":"Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets","summary":"Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to 2.111.2, Realtime authorization does not correctly honor the per-extension presence.read row-level security policy when a private-channel clien…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cwe":["CWE-863"],"vendor":"supabase","product":"realtime","affected":["realtime < 2.111.2"],"published":"2026-09-21","updated":"2026-09-22","sourceUpdated":"2026-09-22T16:17:50.457","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-62247","references":[{"url":"https://github.com/supabase/realtime/commit/c039bca9b57c2e554a67fdf462970b54641d82eb","label":"security-advisories@github.com"},{"url":"https://github.com/supabase/realtime/pull/1969","label":"security-advisories@github.com"},{"url":"https://github.com/supabase/realtime/releases/tag/v2.111.2","label":"security-advisories@github.com"},{"url":"https://github.com/supabase/realtime/security/advisories/GHSA-rcr8-2525-4r7p","label":"security-advisories@github.com"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-22T14:12:26.229589Z"},"ingestedAt":"2026-09-21T19:51:58.880Z","epss":0.00321,"epssPercentile":0.25369,"slug":"CVE-2026-62247","body":"## Overview\n\nSupabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to 2.111.2, Realtime authorization does not correctly honor the per-extension presence.read row-level security policy when a private-channel client is allowed presence.write but explicitly denied presence.read. Under that differential policy, the client can receive presence_diff messages containing other members' presence metadata, including application-defined location, online-status, roster, viewing, or typing information. Deployments with uniform presence visibility have no differential, and postgres_changes row data is unaffected. This issue is fixed in version 2.111.2.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}