Supabase Realtime allows clients to receive presence_diff messages that describe other members’ presence metadata. Due to a flaw in the authorization logic before version 2.111.2, a client granted presence.write but denied presence.read can still retrieve this data. The compromised data can include application-defined location, online status, roster, viewing or typing information, representing a confidentiality breach of user presence state. No integrity or availability impact is reported, and the vulnerability cannot be exploited to execute code or modify database rows. The weakness is identified as CWE‑863, incorrect permission enforcement.

Supabase Realtime deployments using the 2.x branch, specifically any instance running a version older than 2.111.2. The issue does not affect deployments that have uniform presence visibility or that do not use differential row‑level security policies. Please consult the vendor’s release notes for the precise versioning.

The CVSS score of 6.5 indicates a medium severity. The EPSS score is not available, suggesting that published exploit data for this vulnerability is either scarce or not yet recorded. The vulnerability is not listed in the CISA KEV catalog. An attacker must have a legitimately authorized presence.write connection to a private channel; no external arbitrary code execution or privilege escalation is possible beyond the unintended exposure of other users’ presence data. Given the moderate CVSS score and the lack of known public exploits, the likelihood of exploitation is moderate but mitigated by the required authorization level.