CVE-2026-56245: Supabase Capgo - Unauthenticated Cross-Tenant Build-Time Accounting Poisoning via record_build_time RPC
Supabase Capgo before 12.128.2 contains an authorization bypass vulnerability in the SECURITY DEFINER recordbuildtime RPC function that allows unauthenticated attackers to insert arbitrary build-time records. Attackers can exploit this by calling POST /rest/v1/rpc/recordbuildtime with a public API key to poison billing and quota data for any organization, enabling resource exhaustion and cross-tenant billing manipulation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Supabase Capgoto a version that resolves this vulnerability.Fixed in 12.128.2 - Compensating control
Block unauthenticated access to the POST /rest/v1/rpc/record_build_time RPC endpoint (e.g., via firewall/WAF rules) to prevent unauthorized build-time record insertion while upgrading.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56245?
The severity of CVE-2026-56245 is rated high with a CVSS score of 8.2.
How do I fix CVE-2026-56245?
To fix CVE-2026-56245, update Supabase Capgo to version 12.128.2 or later.
What vulnerability does CVE-2026-56245 expose?
CVE-2026-56245 exposes an authorization bypass vulnerability in the record_build_time RPC function.
Who is affected by CVE-2026-56245?
Users of Supabase Capgo versions before 12.128.2 are affected by CVE-2026-56245.
What can attackers do with CVE-2026-56245?
Attackers can exploit CVE-2026-56245 to insert arbitrary build-time records without authentication.