Missing RLS: The Most Underrated Breach Cause of 2026
You know why there are so many breaches in databases? Perfect, me neither. Let's find out in a few minutes. Everyone worries about encryption. Almost nobody worries enough about the one thing that's actually been breaking production databases all year: a table with Row Level Security simply left off. I ran into this while researching how to safely migrate Firestore Security Rules into Postgres…
Recent database breaches underscore a critical but often overlooked security issue: Row Level Security (RLS) left disabled or misconfigured. This oversight has led to the inadvertent exposure of sensitive data across multiple applications and platforms.
During research into migrating Firestore Security Rules to Postgres RLS policies, it became evident that this misconfiguration is the most frequent cause of breaches. In May 2025, a CVE (CVE-2025-48757) highlighted 303 endpoints across 170 applications using Lovable, an AI app-building tool, with publicly readable Supabase tables due to RLS being either never enabled or misconfigured.
Later, in March 2026, an AI platform's database was exfiltrated after an attacker discovered tables with missing RLS, exposing admin emails and internal schema metadata.
Security researchers have found that thousands of Supabase instances globally are misconfigured, making them vulnerable to unauthorized queries via simple curl requests. This issue is not unique to Supabase; Firebase also experienced a similar leak, exposing over 1.8 million users' plaintext passwords and sensitive data from more than 900 mobile apps due to publicly accessible Realtime Database instances.
The root cause is the same: a lack of proper access control configuration. Supabase improved in 2026 by enabling RLS by default on new tables and flagging unsecured tables on its dashboard, but this doesn't address the more challenging scenario of rebuilding access logic during migrations. Migrations often involve recreating access control policies, a task that can be error-prone, especially when translating security rules from one system to another.
Tools like pgrls, a static RLS linter, can help identify common mistakes and vulnerabilities in translated policies. However, these tools are still in development and may not cover all scenarios. The key takeaway is that access control is a crucial but often underestimated aspect of database security. Proper configuration during database migrations is essential to prevent data breaches, and relying solely on manual processes or incomplete tools leaves systems vulnerable.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
