Capgo CVE-2026-56235

Exploitation requires possession of the Capgo Supabase public API key (sb_publishable_*), which is embedded in Capacitor mobile applications distributed to end users and is not treated as a secret credential. No account registration, authentication, org membership, or elevated privilege is needed beyond this key. The attacker must have network access to reach the Supabase PostgREST HTTP endpoint, consistent with the CVSS 4.0 AV:N metric for a publicly accessible SaaS platform. Exploitation is read-only: the vulnerability grants no write, delete, or code-execution capability. Practical exploitation is further shaped by the need to discover or enumerate valid org_id values, though the differential oracle response (metrics vs. empty array) makes this enumeration feasible without additional information. The affected functions were incorrectly granted to anon by default across all Capgo deployments before 12.128.2 - no non-default configuration is required to be vulnerable.

The CVSS 4.0 score of 6.9 accurately reflects a low-complexity, unauthenticated, network-accessible information disclosure with limited confidentiality impact (VC:L). The attack requires no privileges beyond a widely distributed public API key and no user interaction, making it trivially accessible to any motivated party. Real-world impact is bounded by the sensitivity of the disclosed data: usage telemetry (MAU, bandwidth, installs, gets) rather than credentials, PII, or application code. For multi-tenant SaaS operators, however, cross-tenant leakage carries compliance exposure and competitive intelligence risk that can exceed what the CVSS numeric score implies - particularly when combined with app-ID enumeration and org-existence confirmation. The absence of CISA KEV listing and the lack of identified public exploit code keep the near-term threat level moderate. EPSS data was not provided in the source intelligence and cannot be assessed. No conflicting signals exist between the CVSS vector and the description; both consistently indicate a network-accessible unauthenticated read-only disclosure.

An attacker extracts the sb_publishable_* Supabase API key from a decompiled or publicly distributed Capgo-powered mobile application, then issues HTTP POST requests to the PostgREST RPC endpoint for get_app_metrics with sequentially or randomly guessed org_id values. The oracle behavior - valid organizations return telemetry rows, invalid ones return an empty array - enables systematic enumeration of tenant existence followed by bulk harvesting of MAU, bandwidth, and app-ID data across all organizations on the platform. No exploit code has been publicly identified, but the attack requires only standard HTTP tooling and the public API key.