---
id: CVE-2026-62247
title: >-
  Supabase Realtime provides Broadcast, Presence, and Postgres Changes via
  WebSockets
summary: >-
  Supabase Realtime provides Broadcast, Presence, and Postgres Changes via
  WebSockets. Prior to 2.111.2, Realtime authorization does not correctly honor
  the per-extension presence.read row-level security policy when a
  private-channel clien…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-863
vendor: supabase
product: realtime
affected:
  - realtime < 2.111.2
published: '2026-09-21'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T21:25:27.050'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-62247'
references:
  - url: >-
      https://github.com/supabase/realtime/commit/c039bca9b57c2e554a67fdf462970b54641d82eb
    label: security-advisories@github.com
  - url: 'https://github.com/supabase/realtime/pull/1969'
    label: security-advisories@github.com
  - url: 'https://github.com/supabase/realtime/releases/tag/v2.111.2'
    label: security-advisories@github.com
  - url: >-
      https://github.com/supabase/realtime/security/advisories/GHSA-rcr8-2525-4r7p
    label: security-advisories@github.com
tags:
  - nvd
  - cve.org
epss: 0.00451
epssPercentile: 0.36506
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-22T14:12:26.229589Z'
ingestedAt: '2026-09-21T19:51:58.880Z'
---

## Overview

Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to 2.111.2, Realtime authorization does not correctly honor the per-extension presence.read row-level security policy when a private-channel client is allowed presence.write but explicitly denied presence.read. Under that differential policy, the client can receive presence_diff messages containing other members' presence metadata, including application-defined location, online-status, roster, viewing, or typing information. Deployments with uniform presence visibility have no differential, and postgres_changes row data is unaffected. This issue is fixed in version 2.111.2.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.