Realtime
Monthly
Presence metadata disclosure in Supabase Realtime before 2.111.2 lets an authenticated WebSocket client on a private channel receive presence_diff messages containing other members' application-defined presence state - location, online-status, roster, viewing or typing data - even when that channel's per-extension row-level security policy explicitly denies presence.read while still granting presence.write. The defect is an authorization-logic error (CWE-863) in how presence diffs were dispatched past the read policy; it is tightly gated by a non-default asymmetric policy configuration, and there is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score supplied. The vendor's CVSS 6.5 (C:H) likely overstates confidentiality impact, since disclosure is confined to presence metadata and postgres_changes row data is explicitly unaffected, which argues for C:L.
Presence metadata disclosure in Supabase Realtime before 2.111.2 lets an authenticated WebSocket client on a private channel receive presence_diff messages containing other members' application-defined presence state - location, online-status, roster, viewing or typing data - even when that channel's per-extension row-level security policy explicitly denies presence.read while still granting presence.write. The defect is an authorization-logic error (CWE-863) in how presence diffs were dispatched past the read policy; it is tightly gated by a non-default asymmetric policy configuration, and there is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score supplied. The vendor's CVSS 6.5 (C:H) likely overstates confidentiality impact, since disclosure is confined to presence metadata and postgres_changes row data is explicitly unaffected, which argues for C:L.