CVE-2026-56214: Capgo - Unauthenticated Organization Enumeration and Billing Status Disclosure via Supabase RPC
Capgo before 12.128.2 contains an information disclosure vulnerability in Supabase PostgREST RPC endpoints istrialorg and ispayingorg that allows unauthenticated attackers to enumerate organizations and disclose billing status using the public sbpublishable key. Attackers can invoke these endpoints to determine organization existence via distinguishable return values and identify paying customers for targeted profiling.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Capgoto a version that resolves this vulnerability.Fixed in 12.128.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56214?
CVE-2026-56214 has a high severity score of 7.5.
How do I fix CVE-2026-56214?
To fix CVE-2026-56214, update Capgo to version 12.128.2 or later.
What type of vulnerability is CVE-2026-56214?
CVE-2026-56214 is an information disclosure vulnerability that allows unauthenticated access to billing information.
What can attackers do with CVE-2026-56214?
Attackers can use CVE-2026-56214 to enumerate organizations and disclose their billing status.
Which components are affected by CVE-2026-56214?
CVE-2026-56214 affects the Supabase PostgREST RPC endpoints in Capgo.