Medium

INSERT policy "Members create tickets" has no WITH CHECK

Affected:: public.support_tickets
Category:: RLS Security
Confidence:: high
First detected:: 2026-08-12 11:04Z
Last verified:: 2026-08-16 09:41Z

Summary

Writes to public.support_tickets are not validated against the caller's tenant.

Why this matters

A caller can insert rows attributed to another organization, poisoning data another tenant will later read.

Evidence

Relation: public.support_tickets
Policy: Members create tickets
Command: INSERT
WITH CHECK: (none)

Facts above were derived by the scanner from database metadata. No model output is involved in the verdict.

Technical details

pg_policies.with_check is null for a write command, so PostgreSQL accepts any candidate row the caller supplies.

recommended remediation

Unlock the full security analysis

Buy full analysis

Add a WITH CHECK expression binding organization_id to the caller's tenant.

Current

CREATE POLICY "Members create tickets"
ON public.support_tickets
FOR INSERT
TO authenticated;

Proposed

CREATE POLICY "Members create tickets"
ON public.support_tickets
FOR INSERT
TO authenticated
WITH CHECK (
  organization_id = current_tenant_owner()
);

Expected security effect

Row ownership validated on write
Cross-tenant write path removed

Compatibility risk

low

Clients that omit the tenant column on insert will need to set it, or a trigger should default it.

DBX never applies SQL to your database.