CVE-2026-56238: Capgo - Unauthenticated Information Disclosure via PostgREST global_stats Endpoint
Capgo before 12.128.2 contains an information disclosure vulnerability in the Supabase PostgREST globalstats endpoint that allows unauthenticated attackers to read sensitive financial and operational metrics using only the public apikey. Remote attackers can query the /rest/v1/globalstats endpoint to expose MRR, total revenue, plan-tier revenue breakdown, customer counts, and operational telemetry.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56238?
CVE-2026-56238 has a high severity rating of 8.7.
What does CVE-2026-56238 affect?
CVE-2026-56238 affects the Supabase PostgREST global_stats endpoint in Capgo before version 12.128.2.
How does CVE-2026-56238 allow information disclosure?
CVE-2026-56238 allows unauthenticated attackers to access sensitive financial and operational metrics through a public apikey.
What kind of attack is possible with CVE-2026-56238?
CVE-2026-56238 enables remote attackers to perform unauthorized queries on the /rest/v1/global_stats endpoint.
How can organizations protect against CVE-2026-56238?
Organizations should upgrade to Capgo version 12.128.2 or later to mitigate the risk posed by CVE-2026-56238.