PulseAugur
EN
LIVE 21:48:23

Supabase RLS vulnerability can leak all rows to logged-in users

By PulseAugur Editorial · [2 sources] ·

Two Mastodon posts highlight a security vulnerability in Supabase where tables with Row Level Security (RLS) enabled can still expose all rows to any logged-in user. This occurs when the RLS policy is set to 'authenticated can select' without an additional check for row ownership or tenant ID. The posts suggest implementing owner checks within the policy, such as `auth.uid() = user_id`, to prevent such data leaks and recommend testing by attempting to access data from a secondary account. AI

IMPACT Highlights a potential data security flaw in a popular backend-as-a-service platform, relevant for developers building AI applications.

RANK_REASON The cluster discusses a specific technical vulnerability and its mitigation within a database service, which falls under tooling.

Read on Mastodon — mastodon.social →

AI-generated summary · Google Gemini · from 2 sources. How we write summaries →

Supabase RLS vulnerability can leak all rows to logged-in users

How we ranked this

Signal score
1 / 100
Composite score across the factors below. Higher = stronger signal that this story matters right now.
Newsworthiness bucket
Tool
The cluster discusses a specific technical vulnerability and its mitigation within a database service, which falls under tooling.
Source corroboration
2 independent sources
Multiple independent publishers reporting the same story raises confidence that it's real and newsworthy.
Topics
product, safety
Editorial topic classification. Feeds into how the story surfaces on /topic/<slug> hub pages and into the per-entity coverage mix.
AI-industry relevance
High
Clearly on-topic for AI-industry coverage.
Story freshness
Same-day
Cluster formed today. Ranking reflects the current source set at time of score.

Full methodology in our editorial standards.

COVERAGE [2]

  1. Mastodon — mastodon.social TIER_1 English(EN) · abbilabs ·

    A table can show RLS enabled and still hand every row to every signed-in user. That happens when the policy is only "authenticated can select", with no owner or

    A table can show RLS enabled and still hand every row to every signed-in user. That happens when the policy is only "authenticated can select", with no owner or tenant check. Login is not the same as owning the row. How to find tables like that, and the SQL to tighten them: https…

    LINKS abbilabs.xyz/…/supabase-rls-check
  2. Mastodon — mastodon.social TIER_1 English(EN) · abbilabs ·

    A Supabase table with RLS enabled can still leak every row to every signed-in user. That happens when the policy is only "authenticated can select". Being logge

    A Supabase table with RLS enabled can still leak every row to every signed-in user. That happens when the policy is only "authenticated can select". Being logged in is not the same as owning the row. Put the owner check in the policy (auth.uid() = user_id, or your tenant column).…

RELATED ENTITIES

RELATED TOPICS