In plain English
Signing up with a partner email was enough to get a working session, and one form field let anyone claim to be an admin.
The technical account follows below, for readers who want the detail.
Three lessons any team can use
Email confirmation is not optional when an account unlocks access.
Roles belong on the server, never in details the visitor can edit.
Access rules need to be tested, not assumed.
The Challenge
An enterprise SaaS platform built its backend on Supabase with a misconfigured auth layer. The public anon key opened the door, a prior leak had already exposed valid partner domains, and signups on those domains came back instantly confirmed with a live session token, no inbox access needed. Worse, the app read roles straight from client provided signup metadata, so any registrant could simply declare themselves admin.
How We Proved It
Registered on a partner domain for an instant session, injected an admin role through the signup payload, decoded the token to show the privilege baked in, and proved full tenant control. When triage stumbled on reproduction, clarified exactly how the anon key flows through the frontend and why the metadata injection was the real impact, then waited through three quiet weeks until the team confirmed it. Paid as a Critical 9.1 with a $1,800 award, plus guidance to enforce email confirmation and move roles into backend only tables behind proper row level policies.
Redacted program
Apr 26, 2026
Bug Bounty
Full Writeup
Researched and disclosed by Ridwan Adebayo. Read every step, payload, and takeaway.
Read on MediumRelated Case Studies
More disclosures from our researchers.
Know your risk. Strengthen what matters.
Tell us where you are, what you rely on, and what you need to protect. We will help you understand what to do next.