Capgo CVE-2026-56213

The public.upsert_version_meta function must be exposed as a PostgREST RPC endpoint - the default configuration in Capgo's Supabase backend. The attacker requires only the public anon key, which is intentionally distributed in Capgo client applications and is not a protected credential. No authentication, no elevated privileges, no specific user interaction, and no non-default server configuration are required. Exploitation is strictly bounded to integrity writes against the version_meta table; no confidentiality breach, remote code execution, or availability disruption is possible through this vector alone. Deployments on Capgo 12.128.2 or later, or those that have revoked anon EXECUTE permission on the function, are not exploitable.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms fully unauthenticated, low-complexity, network-reachable exploitation with no preconditions - the highest possible exploitability profile. The impact metrics (VC:N/VI:L/VA:N/SC:N/SI:N/SA:N) reflect a narrow integrity-only footprint, yielding a 6.9 base score. The critical nuance that elevates real-world risk above the moderate score is the cross-tenant nature of the write: the public anon key is intentionally distributed to all Capgo clients and is not a secret, meaning any user of the Capgo platform can target any other tenant's app_id. Persistent false data in storage metrics dashboards can cascade to alert fatigue, incorrect billing computations, or misdirected incident response. No CISA KEV listing and no confirmed public exploit code reduce immediate urgency, but the zero-credential requirement means exploitation is within reach of any motivated user. EPSS data was not provided in the input; risk should be weighted toward prompt patching given the trivial attack complexity.

An attacker extracts the Capgo public anon key from a distributed mobile or web application bundle - requiring no authentication or special access - and sends a crafted HTTP POST request to /rest/v1/rpc/upsert_version_meta with a fabricated payload specifying a victim tenant's app_id and inflated storage figures. The SECURITY DEFINER function accepts and persists the forged rows without ownership validation, causing the victim's Capgo dashboard to permanently display corrupted storage metrics and potentially triggering false quota alerts or billing anomalies.