Over 16,000 Supabase databases expose PII, passwords, auth tokens
-
Researchers have identified a large-scale exposure issue affecting applications built on Supabase, the open-source Firebase alternative. More than 16,000 misconfigured Supabase databases were found to be publicly accessible, with readable tables containing personally identifiable information, passwords, or authentication tokens.
The root cause is misconfiguration rather than a flaw in Supabase itself. When developers set up their projects without properly enabling Row Level Security and related access controls, the underlying database tables can be queried by anyone who knows or guesses the project endpoint. In these cases, sensitive records become readable without authentication.
Key points from the research:
- Over 16,000 databases were found exposed due to misconfiguration
- Exposed data includes PII, passwords, and auth tokens
- The issue stems from improperly secured Supabase projects, not a vulnerability in the platform
If you operate a Supabase-backed application, it is worth verifying that Row Level Security is enabled on all tables and that your API keys and access policies are scoped correctly. Exposed credentials and tokens should be rotated promptly if any leak is suspected.
Source: BleepingComputer
Have you checked whether your organization's Supabase projects have RLS properly enforced on every table?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login