Critical
CVSS 9.1 Cloud Misconfig Responsible Disclosure
Disclosure
CRITICAL - Supabase OKR Database Unauthenticated Full Read Access (413 Employee Records)
The OKR platform at okrs.[vendor] exposes a Supabase backend with anon key that grants unauthenticated read access to the entire profiles table containing 413 employee records with full names, job titles, teams, managers, HiBob IDs, and corporate email addresses, including C-level executives (CEO, CTO, CFO)
- Target
- European B2B Spend Management
- Category
- Cloud Misconfig
- Channel
- Responsible Disclosure
- Disclosed
- 2026-04
Redaction note
Vendor identity withheld.
This finding is documented here as part of MemCyber’s public disclosure record. The vendor has been anonymized to a sector and region descriptor. Full technical detail — including root cause, reproducible proof-of-concept, remediation guidance, and vendor attribution where granted — is available to qualified prospects under NDA.
Coordinated disclosure
How we handled it.
- Reported to the vendor via Responsible Disclosure with a reproducible proof-of-concept.
- Triage + remediation window coordinated with the vendor security team.
- Fix verified before any public reference.
- This record published only after the embargo period closed.