2026-11-11 · Daily security tips

Can a user flip is_admin or role on their own row?

Lovable and Supabase apps often put role or is_admin on profiles, then add a policy so users can update their own row. That stops user B editing user A's profile. It does not stop A setting their own role to admin. user_metadata is the same trap: a signed-in user can change it with supabase.auth.updateUser. New Postgres functions start executable by PUBLIC, so an RPC like make_admin may be callable with your public anon key.

Check: as a normal user, try updating your own role or is_admin. You want an error or zero rows changed. In the SQL editor, look for policies reading user_metadata, and functions named make_admin or set_role.

Fix: grant UPDATE only on the columns users should edit, or keep roles in a separate table with no write policies, or in app_metadata, which only the secret key can change. Revoke EXECUTE on admin functions from public, anon and authenticated.