EUVD-2026-38096
GHSA-4q75-4379-394h
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable PostgREST RPC callable with a public anon key (PR:N, AC:L, UI:N); impact is tampering with billing rows so I:H, with no confidentiality or availability loss.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Capgo (Cap-go/capgo) before 12.128.2 contains an improper access control vulnerability in the SECURITY DEFINER PostgREST RPC function public.record_build_time, which is granted to the anon role and callable with only the public Supabase publishable (sb_publishable_*) anon key. An unauthenticated attacker can insert rows into public.build_logs for arbitrary organizations and, because the function uses ON CONFLICT (build_id, org_id) DO UPDATE, can overwrite existing usage/billing records by reusing the same build_id for a target org. This enables cross-tenant tampering of billing build logs and financial-impact denial of service by inflating billable build time.
AnalysisAI
Cross-tenant billing log tampering in Capgo (Cap-go/capgo) before 12.128.2 allows unauthenticated attackers holding only the public Supabase publishable anon key to insert or overwrite build_logs rows for arbitrary organizations via the SECURITY DEFINER PostgREST RPC public.record_build_time. Because the function is granted to the anon role and uses ON CONFLICT (build_id, org_id) DO UPDATE, attackers can inflate or alter another tenant's billable build time, producing financial-impact denial of service. No public exploit identified at time of analysis, though the vendor advisory (GHSA-42xj-3h9w-26h5) and a VulnCheck write-up describe the attack path in detail.
Technical ContextAI
Capgo is a self-hostable live-update / OTA delivery platform for Capacitor mobile apps that uses Supabase (PostgreSQL + PostgREST + Row Level Security) as its backend. The vulnerable surface is a PostgREST RPC function, public.record_build_time, defined as SECURITY DEFINER - meaning it executes with the privileges of its owner and bypasses RLS - and granted EXECUTE to the anon role, which any client bearing the publishable sb_publishable_* anon key can assume. Per CWE-284 (Improper Access Control), the function does not validate that the caller is authorized for the supplied org_id before writing to public.build_logs, and its ON CONFLICT (build_id, org_id) DO UPDATE clause turns insertion into an idempotent upsert, allowing repeated overwrites of an existing tenant's row by reusing the same build_id.
RemediationAI
Vendor-released patch: upgrade Capgo to 12.128.2 or later, per the GitHub Security Advisory GHSA-42xj-3h9w-26h5 (https://github.com/Cap-go/capgo/security/advisories/GHSA-42xj-3h9w-26h5), which corrects the access control on public.record_build_time. For self-hosted operators who cannot upgrade immediately, the most direct compensating control is to REVOKE EXECUTE ON FUNCTION public.record_build_time FROM anon (and PUBLIC) in PostgreSQL so only authenticated roles can call it - this breaks any legitimate anon-key call path that depends on the RPC, so test that build-time recording from clients still works via an authenticated path before rolling out. As an additional control, add an explicit caller-vs-org_id authorization check inside the function body (or drop SECURITY DEFINER in favor of SECURITY INVOKER plus RLS on build_logs), and consider rotating the publishable anon key only if you also restrict the surface it can reach - rotation alone does not help because publishable keys are designed to be shared. Review public.build_logs for anomalous rows with mismatched org_id/build_id pairs created before the upgrade.
Improper access control in Capgo (capgo.app) lets any holder of an ordinary full API key forge a trusted SSO provider by
Authorization bypass in Capgo (capgo.app), a live-update/OTA platform for Capacitor mobile apps, allows a de-provisioned
Account pre-registration hijack in Capgo before 12.128.2 lets a remote unauthenticated attacker claim an account under a
Authentication bypass in Capgo prior to version 12.128.2 lets attackers defeat email-based OTP verification by tampering
Cross-tenant data poisoning in Supabase Capgo before 12.128.2 allows remote unauthenticated attackers to corrupt billing
Capgo's MFA enforcement is defeated by an authentication assurance level (AAL) mismatch across two distinct code paths:
Privilege escalation in the Capgo (capgo.app) backend through version 12.242.4 allows an authenticated API key holder to
Unauthenticated organization enumeration in Capgo before 12.128.2 lets attackers abuse the Supabase PostgREST SECURITY D
Unauthenticated denial of service in Cap-go capgo (capgo-backend) before 12.128.12 allows remote attackers to exhaust Po
Privilege escalation in capgo.app (npm package `capgo` ≤ 12.207.1) allows an authenticated org_member to promote an exte
Account takeover in Cap-go (Capgo) versions prior to 12.128.2 allows an attacker holding a temporary authenticated sessi
SQL injection in Capgo (cap-go) before 12.128.2 allows authenticated users with read-level API keys to access analytics
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today