Researchers identified over 16,000 Supabase databases with publicly readable tables and exposed PII through misconfiguration vulnerabilities. The issue stems from improper Row Level Security policies, overly permissive access controls, and incorrect API exposure rather than a platform vulnerability. More than half of affected databases showed schema indicators suggesting personally identifiable information exposure.
UpGuard discovered approximately 16,000 Supabase-hosted databases publicly exposing sensitive personal data. The exposure stems from misconfigured Row Level Security (RLS) settings and improper access controls, allowing unauthorized public access to live database tables. Many databases were created by AI coding tools that skip RLS by default, leaving customer data accessible without authentication.
CVE-2026-62247 discovered in Supabase Realtime prior to version 2.111.2. A flaw in authorization logic allows clients with presence.write but explicit presence.read denial to receive presence_diff messages containing other members' presence metadata. The vulnerability has a CVSS score of 6.5 and affects per-extension row-level security policies. Fixed in Realtime 2.111.2.
CVE-2025-48757 documents widespread Row Level Security misconfiguration in Supabase projects created by Lovable. A scan of 1,645 live projects found 170+ (approximately 1 in 10) had RLS disabled, exposing user data. The vulnerability scored 9.3 on the CVSS scale. Additionally, an April 2026 Lovable incident exposed users' project source code, database credentials, and chat history due to similar authorization flaws.
CVE-2025-48757 is a critical Row Level Security (RLS) vulnerability in the Lovable-Supabase integration that exposed over 170 production applications to unauthenticated data access. The flaw resulted from misconfigured or unconfigured RLS policies, allowing attackers to perform unauthenticated data dumps from affected applications.
CVE-2026-19333 is a medium-severity command injection vulnerability in NightTrek Supabase-MCP affecting the generate_types component. The flaw allows attackers with local access and low privileges to execute arbitrary commands via manipulation of the schema argument. As of publication (08/09/2026), the vendor has not issued a response or patch.