Incident feed · ShipSecurely

Supabase incidents

2 incidents tagged Supabase, newest first.

Topic

Information disclosureOct 14, 2026
A Supabase Storage anon key could read and overwrite Iceberg analytics files
On October 14, 2026, Supabase published GHSA-67rp-h2mf-ph72 for storage-api 1.80.0 and earlier. A caller with the project's public anon key and an Iceberg table's location could read or overwrite those analytics files without service_role. The advisory rates it Critical, CVSS 3.1 score 9.4, and says 1.80.1 is the fix. The same day, GHSA-8rrf-w776-x75g says 1.80.2 fixes a separate unauthenticated upload bypass.
- Supabase
- Row Level Security
Information disclosureMay 30, 2025
Lovable-generated sites with missing RLS let unauthenticated users read or write tables
On May 30, 2025, CVE-2025-48757 was published for Lovable. It says an insufficient row level security policy through April 15, 2025 let remote unauthenticated attackers read or write arbitrary database tables on generated sites. The record rates that Critical, CVSS 3.1 score 9.3, and notes that the supplier disputes it.