A Supabase Storage anon key could read and overwrite Iceberg analytics files

GHSA-67rp-h2mf-ph72, published October 14, 2026, says Supabase Storage 1.80.0 has an authorization bypass on the S3 routes for Iceberg analytics tables. A caller with the project's public anon key and the S3 location of an existing table could read or overwrite that table's files without the service_role permission. The advisory says the Iceberg handlers skipped the normal row level security checks. It says that could expose data, corrupt tables, disrupt queries, or add storage cost, and that deletion was also possible when ICEBERG_S3_DELETE_ENABLED was enabled. It says turning off the Iceberg catalog feature does not protect files whose catalog entries are still available to the S3 routing lookup.

The advisory's version data lists supabase/storage-api at <= 1.80.0, patched in 1.80.1. It says 1.80.1 requires service_role for requests identified as Iceberg buckets, and that anon or ordinary authenticated requests receive HTTP 403 before the object handlers run. It rates the issue Critical, CVSS 3.1 score 9.4, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L, and assigns CWE-862, Missing Authorization. It lists no CVE id.

The same day, GHSA-8rrf-w776-x75g describes a separate authorization bypass in signed resumable-upload routes. It says unauthenticated callers could create or overwrite objects in public or private buckets, because a request could reach a route that uses a privileged database connection without a valid signed-upload token. Row level security did not apply to that connection. The advisory says an attacker who knew a bucket and object name could create an object, replace one, or empty an existing object with a zero-byte upload. Its version data lists storage-api <= 1.80.1, patched in 1.80.2. It rates that issue Critical, CVSS 3.1 score 9.1, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H, and assigns CWE-172 and CWE-288. It lists no CVE id.