Signup trigger takes the role from self-set metadata
Scan rule · RSC-SEC-118
- Security
- Severity: Critical
- CWE-269
- OWASP A01-2021
Finds a trigger on `auth.users` whose function writes a privilege column (role, plan, is_admin) from `raw_user_meta_data` at signup — values the user supplies themselves when registering.
Why this matters
At signup the client may send arbitrary metadata: `supabase.auth.signUp({ options: { data: { role: 'admin' } } })`. If the `handle_new_user` trigger copies that value into the role or privilege column, anyone makes themselves admin just by registering.
The flaw is invisible to any outside scan: the table is empty anonymously, and the policy may correctly bind to `auth.uid()` — the escalation happens before the policy, in the trigger.
To check: create an account with `data: { role: 'admin' }` and inspect your own row. The fix is a fixed default in the trigger plus separate, server-only role management.
Scan tier
- Repo access (deep scan)
How to fix it
Set the column to a fixed default in the trigger (e.g. 'user'); assign roles only server-side, never from raw_user_meta_data.