CVE-2026-56082: Capgo - Unauthenticated Cross-Tenant Billing Log Tampering via public.record_build_time RPC
Capgo (Cap-go/capgo) before 12.128.2 contains an improper access control vulnerability in the SECURITY DEFINER PostgREST RPC function public.recordbuildtime, which is granted to the anon role and callable with only the public Supabase publishable (sbpublishable) anon key. An unauthenticated attacker can insert rows into public.buildlogs for arbitrary organizations and, because the function uses ON CONFLICT (buildid, orgid) DO UPDATE, can overwrite existing usage/billing records by reusing the same buildid for a target org. This enables cross-tenant tampering of billing build logs and financial-impact denial of service by inflating billable build time.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Capgo (Cap-go/capgo)to a version that resolves this vulnerability.Fixed in 12.128.2 - Configuration
Remove the SECURITY DEFINER attribute from the public.record_build_time function so it no longer executes with the function owner's elevated privileges.
PostgREST RPC function public.record_build_time security_definer = remove - Configuration
Revoke any execute/grant permission on public.record_build_time from the anon role (remove the grant that allows anon to call the function).
PostgREST RPC function public.record_build_time granted_to_role = revoke anon - Configuration
Prevent public.record_build_time from being callable with the public Supabase publishable (sb_publishable_*) anon key by removing or restricting publishable key access to this RPC.
Supabase publishable (sb_publishable_*) anon key callable = false
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56082?
The severity of CVE-2026-56082 is rated high with a score of 8.7.
How do I fix CVE-2026-56082?
To fix CVE-2026-56082, upgrade Capgo to version 12.128.2 or later.
What type of vulnerability is CVE-2026-56082?
CVE-2026-56082 is an unauthenticated cross-tenant billing log tampering vulnerability.
Who is affected by CVE-2026-56082?
Any user implementing Capgo versions prior to 12.128.2 could be affected by CVE-2026-56082.
What is the impact of CVE-2026-56082?
The impact of CVE-2026-56082 allows unauthenticated users to tamper with billing logs through RPC functions.