RLS bypass vulnerabilities occur when database-level access policies are missing, misconfigured, or can be circumvented, exposing data across tenant boundaries.
Row Level Security (RLS) Bypass is a vulnerability specific to applications using database-level access control policies, most commonly with PostgreSQL (used by Supabase). RLS policies define which rows a given user can read, insert, update, or delete. A bypass occurs when these policies are missing, misconfigured, or can be circumvented, allowing users to access data they should not see.
Common RLS bypass scenarios include: tables with RLS not enabled (all data is accessible by default in Supabase when accessed through the API); overly permissive policies (e.g., allowing all authenticated users to read all rows); policies that only check SELECT but not UPDATE or DELETE; using service_role keys in client-side code (bypasses all RLS); policies that reference `auth.uid()` but do not account for all access paths; missing policies on junction tables in many-to-many relationships; and policies that can be bypassed through PostgreSQL functions that run with `SECURITY DEFINER`.
In applications using Supabase or similar database-direct architectures, RLS is the primary security boundary. If RLS is bypassed, attackers can read all data from any table (including other users' data, admin data, and sensitive information), modify or delete records belonging to other users, escalate privileges by modifying their own user record, and access data across tenant boundaries in multi-tenant SaaS applications. Because Supabase exposes the PostgREST API directly and the `anon` key is inherently public (embedded in client code), any table without proper RLS policies is completely exposed. This has been a leading source of data breaches in Supabase applications.
Enable RLS on every table that contains user data. Create explicit policies for each operation (SELECT, INSERT, UPDATE, DELETE) -- do not rely on a single permissive policy. Use `auth.uid()` in policies to filter rows by the authenticated user. Test policies by querying as different users. Never use the `service_role` key in client-side code. Create separate policies for different user roles (admin, user, public). Apply policies to junction tables and related tables, not just primary tables. Use `SECURITY INVOKER` (default) for functions unless you specifically need elevated privileges. Audit all tables regularly with `SELECT tablename, rowsecurity FROM pg_tables WHERE schemaname = 'public'`. Test RLS policies as part of your CI/CD pipeline. Consider using Supabase's built-in RLS testing tools.
Select your framework for a detailed guide on fixing Row Level Security (RLS) Bypass with framework-specific code examples and security checklists.
Cross-Site Scripting (XSS)
XSS allows attackers to inject malicious scripts into web pages viewed by other users, enabling session hijacking, data theft, and defacement.
SQL Injection
SQL Injection allows attackers to interfere with database queries, potentially reading, modifying, or deleting data, and in some cases executing system commands.
Cross-Site Request Forgery (CSRF)
CSRF forces authenticated users to execute unwanted actions on a web application, exploiting the trust a site has in a user's browser.
Insecure Direct Object References (IDOR)
IDOR occurs when an application exposes internal implementation objects (like database IDs) and fails to verify that users are authorized to access the referenced resource.
Broken Authentication
Broken authentication encompasses weaknesses in session management, credential handling, and identity verification that allow attackers to compromise user accounts.
Security Misconfiguration
Security misconfiguration encompasses insecure default settings, open cloud storage, verbose error messages, unnecessary features, and missing security headers.
Sensitive Data Exposure
Sensitive data exposure occurs when applications fail to adequately protect sensitive information like credentials, tokens, personal data, or financial information.
Missing Rate Limiting
Missing rate limiting allows attackers to perform brute force attacks, credential stuffing, API abuse, and denial of service by making unlimited requests.
JWT Vulnerabilities
JWT vulnerabilities include algorithm confusion, missing validation, token leakage, and improper key management that can lead to authentication bypass.
Path Traversal
Path traversal allows attackers to access files and directories stored outside the intended directory by manipulating file path references.
Command Injection
Command injection allows attackers to execute arbitrary operating system commands on the server through vulnerable application interfaces.
Server-Side Request Forgery (SSRF)
SSRF allows attackers to induce the server to make HTTP requests to arbitrary destinations, potentially accessing internal services, metadata APIs, and private networks.
File Upload Vulnerabilities
Insecure file upload handling can allow attackers to upload malicious files including web shells, malware, or files that exploit server-side processing.
Insecure Deserialization
Insecure deserialization allows attackers to manipulate serialized objects to achieve remote code execution, replay attacks, injection, or privilege escalation.
SafeVibe runs automated penetration tests to detect Row Level Security (RLS) Bypass and 14 other vulnerability types in your application.
Start Free Scan