{
  "id": 7020822,
  "title": "Missing RLS: The Most Underrated Breach Cause of 2026",
  "url": "https://urgent.news/2026/09/12/missing-rls-the-most-underrated-breach-cause-of-2026",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-12T23:19:25.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/keymelgaston/missing-rls-the-most-underrated-breach-cause-of-2026-1o4a"
  },
  "original_language": "en",
  "account": "Recent database breaches underscore a critical but often overlooked security issue: Row Level Security (RLS) left disabled or misconfigured. This oversight has led to the inadvertent exposure of sensitive data across multiple applications and platforms.\n\nDuring research into migrating Firestore Security Rules to Postgres RLS policies, it became evident that this misconfiguration is the most frequent cause of breaches. In May 2025, a CVE (CVE-2025-48757) highlighted 303 endpoints across 170 applications using Lovable, an AI app-building tool, with publicly readable Supabase tables due to RLS being either never enabled or misconfigured. Later, in March 2026, an AI platform's database was exfiltrated after an attacker discovered tables with missing RLS, exposing admin emails and internal schema metadata.\n\nSecurity researchers have found that thousands of Supabase instances globally are misconfigured, making them vulnerable to unauthorized queries via simple curl requests. This issue is not unique to Supabase; Firebase also experienced a similar leak, exposing over 1.8 million users' plaintext passwords and sensitive data from more than 900 mobile apps due to publicly accessible Realtime Database instances.\n\nThe root cause is the same: a lack of proper access control configuration. Supabase improved in 2026 by enabling RLS by default on new tables and flagging unsecured tables on its dashboard, but this doesn't address the more challenging scenario of rebuilding access logic during migrations. Migrations often involve recreating access control policies, a task that can be error-prone, especially when translating security rules from one system to another.\n\nTools like pgrls, a static RLS linter, can help identify common mistakes and vulnerabilities in translated policies. However, these tools are still in development and may not cover all scenarios. The key takeaway is that access control is a crucial but often underestimated aspect of database security. Proper configuration during database migrations is essential to prevent data breaches, and relying solely on manual processes or incomplete tools leaves systems vulnerable.",
  "summary": "You know why there are so many breaches in databases? Perfect, me neither. Let's find out in a few minutes. Everyone worries about encryption. Almost nobody worries enough about the one thing that's actually been breaking production databases all year: a table with Row Level Security simply left off. I ran into this while researching how to safely migrate Firestore Security Rules into Postgres…",
  "key_points": [
    "Row Level Security (RLS) misconfiguration leads to data breaches.",
    "CVE-2025-48757 exposed 303 endpoints in 170 apps due to RLS issues.",
    "Supabase improved RLS default in 2026, but migration errors persist."
  ],
  "editors_take": "Disabling or misconfiguring Row Level Security leaves databases vulnerable to breaches, a critical issue often overlooked until costly data exposure occurs, highlighting the need for rigorous access control during migrations.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}