The vulnerability arises because the row-level security UPDATE policy on the public.orgs table permits an org admin (holding org.update_settings) to update all fields, including customer_id, despite the official update endpoint restricting editable fields and the billing route requiring a separate org.update_billing permission. By sending updates directly to Supabase PostgREST, an authenticated org admin lacking billing permissions can manipulate the customer_id field, disrupting billing validation and plan status. This leads to denial of paid plan benefits without proper authorization. No fix has been released yet.

An authenticated organization admin without billing update permissions can corrupt or nullify the Stripe customer_id pointer, causing the system to fail billing and plan validation checks. This results in the affected organization losing access to paid plan features and being treated as unpaid or without a plan, potentially disrupting service or billing processes.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, organizations should restrict direct access to the Supabase PostgREST interface and monitor for unauthorized attempts to update the public.orgs table outside the official update endpoint.