An authorization flaw in Supabase Realtime allows authenticated users to access restricted presence metadata, posing a risk of unauthorized information disclosure.

This vulnerability is an incorrect authorization issue (CWE-863) where the Realtime engine fails to enforce per-extension presence.read policies. An authenticated client with presence.write permissions can bypass security controls to receive presence_diff messages intended for restricted users.

The vulnerability allows for the unauthorized exposure of sensitive user metadata, including real-time location, online status, and activity patterns. Given the CVSS score of 6.5, this medium-severity issue could lead to significant privacy breaches and compliance failures in applications relying on presence data. Unauthorized access to this telemetry can facilitate targeted social engineering or further reconnaissance against user accounts.

Immediate Action: Upgrade the Supabase Realtime library to version 2.111.2 or later to apply the necessary authorization logic fixes.

Proactive Monitoring: Review WebSocket traffic and access logs for unusual presence.read patterns or anomalous metadata retrieval requests originating from clients with limited permissions.

Compensating Controls: Ensure that presence visibility policies are applied uniformly across the deployment if an immediate update is not feasible, as environments without differential visibility are not impacted by this flaw.

Public Exploit Available: Unknown

Organizations utilizing Supabase Realtime should prioritize upgrading to version 2.111.2 to eliminate this authorization bypass. While the vulnerability requires authenticated access, the potential for sensitive metadata leakage necessitates prompt remediation to maintain user privacy and system integrity.