16,000 Supabase databases misconfigured, data exposed

Security researchers have identified more than 16,000 Supabase databases that were misconfigured, leaving readable tables containing sensitive data publicly accessible. The exposed information includes personally identifiable information (PII), passwords, and authentication tokens, posing significant risks for affected users and organizations.

What happened

The misconfigurations were discovered during a scan of publicly accessible Supabase instances. Researchers noted that the exposed data resulted from improperly set access controls, which allowed unauthorized parties to view or extract information without authentication. The exact number of affected databases—16,000—was confirmed, though the total volume of exposed records remains unclear. Supabase, an open-source Firebase alternative, provides backend-as-a-service solutions, including database management, authentication, and storage.

The source did not specify whether any breaches or unauthorized access incidents have occurred as a result of these misconfigurations. It is also unclear how long the databases have been exposed or whether affected organizations have been notified.

What we don't know yet

Details about the duration of the exposure, the geographic distribution of affected databases, and whether any malicious actors have exploited the misconfigurations are not available. Additionally, the researchers did not disclose whether Supabase has taken steps to address the issue or notify impacted users. Further investigation is needed to determine the full scope of the risk and potential remediation efforts.