{"id":"CVE-2026-62247","summary":"Supabase Realtime: Incorrect Authorization","details":"Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to 2.111.2, Realtime authorization does not correctly honor the per-extension presence.read row-level security policy when a private-channel client is allowed presence.write but explicitly denied presence.read. Under that differential policy, the client can receive presence_diff messages containing other members' presence metadata, including application-defined location, online-status, roster, viewing, or typing information. Deployments with uniform presence visibility have no differential, and postgres_changes row data is unaffected. This issue is fixed in version 2.111.2.","aliases":["GHSA-rcr8-2525-4r7p"],"modified":"2026-09-24T03:30:18.444276206Z","published":"2026-09-21T19:04:58.743Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/62xxx/CVE-2026-62247.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-863"]},"references":[{"type":"WEB","url":"https://github.com/supabase/realtime/releases/tag/v2.111.2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/62xxx/CVE-2026-62247.json"},{"type":"ADVISORY","url":"https://github.com/supabase/realtime/security/advisories/GHSA-rcr8-2525-4r7p"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62247"},{"type":"FIX","url":"https://github.com/supabase/realtime/commit/c039bca9b57c2e554a67fdf462970b54641d82eb"},{"type":"FIX","url":"https://github.com/supabase/realtime/pull/1969"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/supabase/realtime","events":[{"introduced":"0"},{"fixed":"c039bca9b57c2e554a67fdf462970b54641d82eb"},{"fixed":"631e075c2f3b38129bb550a901bc31369e221baf"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"2.111.2"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v2.111.1","v2.111.0","v2.110.0","v2.109.1","v2.109.0","v2.108.0","v2.107.5","v2.107.4","v2.107.3","v2.107.2","v2.107.1","v2.107.0","v2.106.0","v2.105.2","v2.105.1","v2.105.0","v2.104.2","v2.104.1","v2.104.0","v2.103.4","v2.103.3","v2.103.2","v2.103.1","v2.103.0","v2.102.3","v2.102.2","v2.102.1","v2.102.0","v2.101.0","v2.100.0","v2.99.0","v2.98.4","v2.98.3","v2.98.2","v2.98.1","v2.98.0","v2.97.3","v2.97.2","v2.97.1","v2.97.0","v2.96.2","v2.96.3","v2.96.1","v2.96.0","v2.95.0","v2.94.3","v2.94.2","v2.94.1","v2.94.0","v2.93.5","v2.93.4","v2.93.3","v2.93.2","v2.93.1","v2.93.0","v2.92.2","v2.92.1","v2.92.0","v2.91.0","v2.90.1","v2.90.0","v2.89.3","v2.89.2","v2.89.1","v2.89.0","v2.88.2","v2.88.1","v2.88.0","v2.87.0","v2.86.3","v2.86.2","v2.86.0","v2.86.1","v2.85.2","v2.85.1","v2.85.0","v2.84.0","v2.83.3","v2.83.2","v2.82.1","v2.83.1","v2.83.0","v2.82.0","v2.81.1","v2.81.0","v2.80.13","v2.80.12","v2.80.11","v2.80.10","v2.80.9","v2.80.8","v2.80.7","v2.80.6","v2.80.5","v2.80.4","v2.80.3","v2.80.2","v2.80.1","v2.80.0","v2.79.0","v2.78.19","v2.78.18","v2.78.17","v2.78.16","v2.78.15","v2.78.14","v2.78.13","v2.78.12","v2.78.11","v2.78.10","v2.78.9","v2.78.8","v2.78.7","v2.78.6","v2.78.5","v2.78.4","v2.78.3","v2.78.2","v2.78.1","v2.78.0","v2.77.0","v2.76.7","v2.76.6","v2.76.5","v2.76.4","v2.76.3","v2.76.2","v2.76.1","v2.76.0","v2.75.2","v2.75.1","v2.75.0","v2.74.9","v2.74.8","v2.74.7","v2.74.6","v2.74.5","v2.74.4","v2.74.3","v2.74.2","v2.74.1","v2.74.0","v2.73.7","v2.73.6","v2.73.5","v2.73.4","v2.73.3","v2.73.2","v2.73.1","v2.73.0","v2.72.0","v2.71.5","v2.71.4","v2.71.3","v2.71.2","v2.71.1","v2.71.0","v2.70.0","v2.69.2","v2.69.1","v2.69.0","v2.68.7","v2.68.6","v2.68.5","v2.68.4","v2.68.3","v2.68.2","v2.68.1","v2.68.0","v2.67.8","v2.67.7","v2.67.6","v2.67.5","v2.67.4","v2.67.3","v2.67.2","v2.67.1","v2.67.0","v2.66.4","v2.66.3","v2.66.2","v2.66.1","v2.66.0","v2.65.3","v2.65.2","v2.65.1","v2.65.0","v2.64.0","v2.63.3","v2.63.2","v2.63.1","v2.63.0","v2.62.0","v2.61.1","v2.61.0","v2.60.0","v2.59.1","v2.59.0","v2.58.2","v2.58.1","v2.58.0","v2.57.6","v2.57.5","v2.57.4","v2.57.3","v2.57.2","v2.57.1","v2.57.0","v2.56.5","v2.56.4","v2.56.3","v2.56.2","v2.56.1","v2.56.0","v2.55.2","v2.55.1","v2.55.0","v2.54.4","v2.54.3","v2.54.2","v2.54.1","v2.54.0","v2.53.4","v2.53.3","v2.53.2","v2.53.1","v2.53.0","v2.52.1","v2.52.0","v2.51.15","v2.51.14","v2.51.13","v2.51.12","v2.51.11","v2.51.10","v2.51.9","v2.51.8","v2.51.7","v2.51.6","v2.51.5","v2.51.4","v2.51.3","v2.51.2","v2.51.1","v2.51.0","v2.50.2","v2.47.4","v2.48.2","v2.50.1","v2.50.0","v2.49.0","v2.48.1","v2.48.0","v2.47.3","v2.47.2","v2.47.1","v2.47.0","v2.46.4","v2.46.3","v2.46.2","v2.46.1","v2.46.0","v2.45.0","v2.44.0","v2.43.2","v2.43.1","v2.43.0","v2.42.6","v2.42.5","v2.42.4","v2.42.3","v2.42.2","v2.42.1","v2.42.0","v2.41.25","v2.41.24","v2.41.23","v2.41.22","v2.41.21","v2.41.20","v2.41.19","v2.41.18","v2.41.17","v2.41.16","v2.41.15","v2.41.14","v2.41.13","v2.41.12","v2.41.11","v2.41.10","v2.41.9","v2.41.8","v2.41.7","v2.41.6","v2.41.5","v2.41.4","v2.41.3","v2.41.2","v2.40.11","v2.41.1","v2.41.0","v2.40.10","v2.40.9","v2.40.8","v2.40.7","v2.40.6","v2.40.5","v2.40.4","v2.40.3","v2.40.2","v2.40.1","v2.40.0","v2.39.6","v2.39.5","v2.39.4","v2.39.3","v2.39.2","v2.39.1","v2.39.0","v2.38.0","v2.37.11","v2.37.10","v2.37.9","v2.37.8","v2.37.7","v2.37.6","v2.37.5","v2.37.4","v2.37.3","v2.37.2","v2.37.1","v2.37.0","v2.36.21","v2.36.20","v2.36.19","v2.36.18","v2.36.17","v2.36.16","v2.36.15","v2.36.14","v2.36.13","v2.36.12","v2.36.11","v2.36.10","v2.36.9","v2.36.8","v2.36.7","v2.36.6","v2.36.5","v2.36.4","v2.36.3","v2.36.2","v2.36.1","v2.36.0","v2.35.8","v2.35.7","v2.35.6","v2.35.5","v2.35.4","v2.35.3","v2.35.2","v2.35.1","v2.35.0","v2.34.55","v2.34.54","v2.34.53","v2.34.52","v2.34.51","v2.34.50","v2.34.49","v2.34.48","v2.34.47","v2.34.46","v2.34.45","v2.34.44","v2.34.43","v2.34.42","v2.34.41","v2.34.40","v2.34.39","v2.34.38","v2.34.37","v2.34.36","v2.34.35","v2.34.34","v2.34.33","v2.34.32","v2.34.31","v2.34.30","v2.34.29","v2.34.28","v2.34.27","v2.34.26","v2.34.25","v2.34.24","v2.34.23","v2.34.22","v2.34.21","v2.34.20","v2.34.19","v2.34.18","v2.34.17","v2.34.16","v2.34.15","v2.34.14","v2.34.13","v2.34.12","v2.34.11","v2.34.10","v2.34.9","v2.34.8","v2.34.7","v2.34.6","v2.34.5","v2.34.4","v2.34.3","v2.34.2","v2.34.1","v2.34.0","v2.33.84","v2.33.83","v2.33.82","v2.33.81","v2.33.80","v2.33.79","v2.33.78","v2.33.77","v2.33.76","v2.33.75","v2.33.74","v2.33.73","v2.33.72","v2.33.71","v2.33.70","v2.33.69","v2.33.68","v2.33.67","v2.33.66","v2.33.65","v2.33.64","v2.33.63","v2.33.62","v2.33.61","v2.33.60","v2.33.59","v2.33.58","v2.33.57","v2.33.56","v2.33.55","v2.33.54","v2.33.53","v2.33.52","v2.33.51","v2.33.50","v2.33.49","v2.33.48","v2.33.47","v2.33.46","v2.33.45","v2.33.44","v2.33.43","v2.33.42","v2.33.41","v2.33.40","v2.33.39","v2.33.38","v2.33.37","v2.33.36","v2.33.35","v2.33.34","v2.33.33","v2.33.32","v2.33.31","v2.33.30","v2.33.29","v2.33.28","v2.33.27","v2.33.26","v2.33.25","v2.33.24","v2.33.23","v2.33.22","v2.33.21","v2.33.20","v2.33.19","v2.33.18","v2.33.17","v2.33.16","v2.33.15","v2.33.14","v2.33.13","v2.33.12","v2.33.11","v2.33.10","v2.33.9","v2.33.8","v2.33.7","v2.33.6","v2.33.5","v2.33.4","v2.33.3","v2.33.2","v2.33.1","v2.33.0","v2.32.12","v2.32.11","v2.32.10","v2.32.9","v2.32.8","v2.32.7","v2.32.6","v2.32.5","v2.32.4","v2.32.3","v2.32.2","v2.32.1","v2.32.0","v2.31.0","v2.30.34","v2.30.33","v2.30.32","v2.30.31","v2.30.30","v2.30.29","v2.30.28","v2.30.27","v2.30.26","v2.30.25","v2.30.24","v2.30.23","v2.30.22","v2.30.21","v2.30.20","v2.30.19","v2.30.18","v2.30.17","v2.30.16","v2.30.15","v2.30.14","v2.30.13","v2.30.12","v2.30.11","v2.30.10","v2.30.9","v2.30.8","v2.30.7","v2.30.6","v2.30.5","v2.30.4","v2.30.3","v2.30.2","v2.30.1","v2.30.0","v2.29.17","v2.29.16","v2.29.15","v2.29.14","v2.29.13","v2.29.12","v2.29.11","v2.29.10","v2.29.9","v2.29.8","v2.29.7","v2.29.6","v2.29.5","v2.29.4","v2.29.3","v2.29.2","v2.29.1","v2.29.0","v2.28.40","v2.28.39","v2.28.38","v2.28.37","v2.28.36","v2.28.35","v2.28.34","v2.28.33","v2.28.32","v2.28.31","v2.28.30","v2.28.29","v2.28.28","v2.28.27","v2.28.26","v2.28.25","v2.28.24","v2.28.23","v2.28.22","v2.28.21","v2.28.20","v2.28.19","v2.28.18","v2.28.17","v2.28.16","v2.28.15","v2.28.14","v2.28.13","v2.28.12","v2.28.11","v2.28.10","v2.28.9","v2.28.8","v2.28.7","v2.28.6","v2.28.5","v2.28.4","v2.28.3","v2.28.2","v2.28.1","v2.28.0","v2.27.7","v2.27.6","v2.27.5","v2.27.4","v2.27.3","v2.27.2","v2.27.1","v2.27.0","v2.26.8","v2.26.7","v2.26.6","v2.26.5","v2.26.4","v2.26.3","v2.26.2","v2.26.1","v2.26.0","v2.25.70","v2.25.69","v2.25.68","v2.25.67","v2.25.66","v2.25.65","v2.25.64","v2.25.63","v2.25.62","v2.25.61","v2.25.60","v2.25.59","v2.25.58","v2.25.57","v2.25.56","v2.25.55","v2.25.54","v2.25.53","v2.25.52","v2.25.51","v2.25.50","v2.25.49","v2.25.48","v2.25.47","v2.25.46","v2.25.45","v2.25.44","v2.25.43","v2.25.42","v2.25.41","v2.25.40","v2.25.39","v2.25.38","v2.25.37","v2.25.36","v2.25.35","v2.25.34","v2.25.33","v2.25.32","v2.25.31","v2.25.30","v2.25.29","v2.25.28","v2.25.27","v2.25.26","v2.25.25","v2.25.24","v2.25.23","v2.25.22","v2.25.21","v2.25.20","v2.25.19","v2.25.18","v2.25.17","v2.25.16","v2.25.15","v2.25.14","v2.25.13","v2.25.12","v2.25.11","v2.25.10","v2.25.9","v2.25.8","v2.25.7","v2.25.6","v2.25.5","v2.25.4","v2.25.3","v2.25.2","v2.25.1","v2.25.0","v2.24.2","v2.24.1","v2.24.0","v2.23.3","v2.23.2","v2.23.1","v2.23.0","v2.22.29","v2.22.28","v2.22.27","v2.22.26","v2.22.25","v2.22.24","v2.22.23","v2.22.22","v2.22.21","v2.22.20","v2.22.19","v2.22.18","v2.22.17","v2.22.16","v2.22.15","v2.22.14","v2.22.13","v2.22.12","v2.22.11","v2.22.10","v2.22.9","v2.22.8","v2.22.7","v2.22.6","v2.22.5","v2.22.4","v2.22.3","v2.22.2","v2.22.1","v2.22.0","v2.21.1","v2.21.0","v2.20.4","v2.20.3","v2.20.2","v2.20.1","v2.20.0","v2.19.5","v2.19.4","v2.19.3","v2.19.2","v2.19.1","v2.19.0","v2.18.1","v2.18.0","v2.17.2","v2.17.1","v2.17.0","v2.16.0","v2.15.0","v2.14.0","v2.13.2","v2.13.1","v2.13.0","v2.12.7","v2.12.6","v2.12.5","v2.12.4","v2.12.3","v2.12.2","v2.12.1","v2.12.0","v2.11.0","v2.10.1","v2.10.0","v2.9.3","v2.9.2","v2.9.1","v2.9.0","v2.8.2","v2.8.1","v2.8.0","v2.7.0","v2.6.0","v2.1.0","v2.0.3","v2.0.2","v2.0.1","v2.0.0","v1.0.0","v0.25.1","v0.25.0","v0.24.2","v0.24.1","v0.24.0","v0.23.0","v0.22.7","v0.22.6","v0.22.5","v0.22.4","v0.22.3","v0.22.2","v0.22.1","v0.22.0","v0.21.0","v0.20.4","v0.20.3","v0.20.2","v0.20.1","v0.20.0","v0.19.5","v0.19.4","v0.19.3","v0.19.2","v0.19.1","v0.19.0","v0.18.1","v0.18.0","v0.17.2","v0.17.1","v0.17.0","v0.16.0","v0.15.0","v0.14.4","v0.14.3","v0.14.2","v0.14.1","v0.14.0","v0.13.3","v0.13.2","v0.13.1","v0.13.0","v0.12.0","v0.11.1","v0.11.0","v0.10.6","v0.10.5","v0.10.4","v0.10.3","v0.10.2","v0.10.1","v0.10.0","v0.9.7","v0.9.6","v0.9.5","v0.9.4","v0.9.3","v0.9.2","v0.9.1","v0.9.0","v0.8.0","v0.7.11","v0.7.10","v0.7.9","v0.7.8","v0.7.7","0.7.5","0.7.4","0.7.3","0.7.0","push","0.6.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-62247.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}]}