Supabase Sign-Up Metadata Let Users Become Owners

Tier A · Patch today – Before you go home

Who’s exposed: Production apps whose handle_new_user trigger reads roles from user metadata

Tier A because: Core infrastructure or popular tool AND remote, no login AND full takeover

Reach

Attack

Damage

Fix

Popular tool · Remote, no login · Full takeover

What to do

Stop reading roles from raw_user_meta_data and look up the role from a server-controlled table in handle_new_user

The Brief

raw_user_meta_data holds whatever the browser passes to supabase.auth.signUp().
On one production app, the handle_new_user trigger read the new user's role from that metadata, so anyone could sign up with the Owner role id.
The described fix takes the role from a table instead of user metadata.

Any Supabase app that trusts client-supplied sign-up metadata for authorization can let attackers choose their own privileges at registration.

Checklist · 4 of 10 yes

Yes	Hits tech teams	Supabase is a backend platform that developers build and run applications on.
No	Core infrastructure	Supabase is a single vendor's backend product, not software nearly every team runs.
Yes	Popular tool	Supabase is a widely used developer backend platform, though not top-tier mainstream.
No	Exploited in the wild	DEV Community describes the flaw as a vulnerability on one app; no observed attacks are reported.
No	Public exploit	DEV Community describes the flaw and fix; no published exploit code or PoC is mentioned.
Yes	Remote, no login	DEV Community: anyone could sign up with the Owner role id, requiring no credentials.
Yes	Full takeover	DEV Community: users could sign up as Owner and own the account, a privilege escalation.
No	Secrets exposed	DEV Community reports no stolen credentials, tokens, keys, or customer data.
No	Supply chain	DEV Community describes an application logic flaw, not malicious code in a trusted channel.
No	No fix yet	DEV Community states the fix is to read the role from a table, so a fix is described.

First seen 1d ago · 1 source · Full story page · How tiers are decided