CVE-2026-56235: Capgo - Unauthenticated Cross-Tenant Metrics Disclosure via RPC Functions
Cap-go capgo before 12.128.2 contains an authorization bypass in several Supabase PostgREST RPC functions (getappmetrics, getglobalmetrics, gettotalmetrics) that are granted to the anon role without enforcing org membership or permission checks. An unauthenticated attacker using only the public Supabase API key (sbpublishable) can query arbitrary orgid values to disclose cross-tenant usage telemetry (MAU, bandwidth, installs, gets), enumerate app IDs for a target org, and determine org existence via an oracle (valid org returns metrics, invalid returns []).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Cap-go capgoto a version that resolves this vulnerability.Fixed in 12.128.2 - Configuration
Revoke EXECUTE privileges on get_app_metrics, get_global_metrics, and get_total_metrics from the anon role to prevent unauthenticated access and cross-tenant metric disclosure.
PostgREST RPC functions (get_app_metrics, get_global_metrics, get_total_metrics) EXECUTE privilege for role 'anon' = REVOKED
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56235?
The severity of CVE-2026-56235 is medium with a score of 5.3.
How do I fix CVE-2026-56235?
To fix CVE-2026-56235, upgrade Capgo to version 12.128.2 or later.
What vectors are affected by CVE-2026-56235?
CVE-2026-56235 is affected by unauthorized access to several Supabase PostgREST RPC functions.
What type of vulnerability is CVE-2026-56235?
CVE-2026-56235 is an authorization bypass resulting in unauthenticated cross-tenant metrics disclosure.
Who is impacted by CVE-2026-56235?
Users of Capgo prior to version 12.128.2 who rely on RPC functions for metrics access are impacted by CVE-2026-56235.