Security fix
This release fixes a critical vulnerability (GHSA-3qhr-gqmr-q827): the server accepted sign-ups after the first user was created. Anyone who could reach the Supabase API of an Atomic CRM instance could create an account and get full read/write access to all CRM data.
All users should upgrade.
What changed
- Public sign-up is now closed once the first user exists. Administrators add users from the Users page, as before. SAML SSO users are still created on their first login.
- Creating a user outside the Users page (Supabase dashboard Add user / Invite user, or a script calling
auth.admin.createUser) now fails with a "Database error saving new user" error. To create users from a script, first insert the new user's id into theuser_invitationstable using the service role key, then create the user with that id. See Auth API Endpoints.
How to upgrade
This release includes a database migration and an updated edge function. After pulling the release:
- Apply the migration:
npx supabase db push - Deploy the
usersedge function:npx supabase functions deploy users - Redeploy the frontend as usual.
Check your existing users
The fix prevents new unauthorized sign-ups but does not remove accounts that were already created this way. After upgrading, review the Users page (or Authentication > Users in the Supabase dashboard) and disable any account you don't recognize.
Full Changelog: v1.6.0...v1.6.1