EUVD-2026-38117
GHSA-g938-xgc8-q827
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible anon-role RPC using a public API key; impact limited to read-only telemetry disclosure with no integrity, availability, or scope-change effects.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Cap-go capgo before 12.128.2 contains an authorization bypass in several Supabase PostgREST RPC functions (get_app_metrics, get_global_metrics, get_total_metrics) that are granted to the anon role without enforcing org membership or permission checks. An unauthenticated attacker using only the public Supabase API key (sb_publishable_*) can query arbitrary org_id values to disclose cross-tenant usage telemetry (MAU, bandwidth, installs, gets), enumerate app IDs for a target org, and determine org existence via an oracle (valid org returns metrics, invalid returns []).
AnalysisAI
Cross-tenant information disclosure in Capgo (cap-go/capgo) before version 12.128.2 exposes per-organization usage telemetry to any caller holding the publicly distributed Supabase API key. Three PostgREST RPC functions - get_app_metrics, get_global_metrics, and get_total_metrics - are granted to the Supabase anon role without enforcing org membership or permission checks, allowing queries against arbitrary org_id values to return MAU, bandwidth, installs, and app IDs belonging to other tenants. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis; a vendor-released patch exists at version 12.128.2.
Technical ContextAI
Capgo is a Capacitor-based live-update platform (CPE: cpe:2.3:a:cap-go:capgo:*:*:*:*:*:*:*:*) that uses Supabase as its backend infrastructure, which exposes PostgreSQL functions as HTTP REST endpoints via PostgREST. In Supabase's permission model, the anon role is issued a non-secret, publicly embeddable project key (sb_publishable_*) intended for anonymous, unauthenticated callers, subject to Row Level Security (RLS) policies. The root cause (CWE-200: Exposure of Sensitive Information to Unauthorized Actor) is that all three RPC functions accept an org_id parameter and return that organization's telemetry without verifying the caller is a member of or authorized for that organization. Because the functions are bound to the anon role, possession of the public API key - routinely distributed inside Capacitor mobile apps - is the sole prerequisite. An additional oracle effect arises from the differential response: a valid org_id returns metric rows while an invalid one returns an empty array, enabling systematic enumeration of tenant existence.
RemediationAI
Upgrade Capgo to version 12.128.2 or later, which is the vendor-confirmed fix per GitHub Security Advisory GHSA-gfpq-vphf-6gcm. The patch is expected to revoke anon-role EXECUTE privileges on the affected functions and enforce caller-side org membership verification - either through Supabase Row Level Security policies or JWT claim validation within the function body. For self-hosted Capgo deployments that cannot immediately upgrade, a targeted compensating control is to manually revoke the anon role's EXECUTE privilege on get_app_metrics, get_global_metrics, and get_total_metrics in PostgreSQL (REVOKE EXECUTE ON FUNCTION ... FROM anon); note this will break all anonymous metric access until the patched version is deployed. Restricting inbound access to the Supabase PostgREST endpoint at the network layer (IP allowlisting, API gateway rate limiting) can reduce exposure surface but does not eliminate the underlying authorization flaw and should not be treated as a substitute for patching.
Account pre-registration hijack in Capgo before 12.128.2 lets a remote unauthenticated attacker claim an account under a
Authentication bypass in Capgo prior to version 12.128.2 lets attackers defeat email-based OTP verification by tampering
Cross-tenant data poisoning in Supabase Capgo before 12.128.2 allows remote unauthenticated attackers to corrupt billing
Unauthenticated organization enumeration in Capgo before 12.128.2 lets attackers abuse the Supabase PostgREST SECURITY D
Unauthenticated denial of service in Cap-go capgo (capgo-backend) before 12.128.12 allows remote attackers to exhaust Po
Cross-tenant billing log tampering in Capgo (Cap-go/capgo) before 12.128.2 allows unauthenticated attackers holding only
Account takeover in Cap-go (Capgo) versions prior to 12.128.2 allows an attacker holding a temporary authenticated sessi
SQL injection in Capgo (cap-go) before 12.128.2 allows authenticated users with read-level API keys to access analytics
Privilege inversion in Cap-go (Capgo) before 12.128.2 lets holders of read-only API keys cancel running native builds by
Denial of service in Capgo Console versions prior to 12.28.2 allows an authenticated attacker to lock legitimate users o
Capgo's Enforce Password Policy feature in versions before 12.128.2 permanently locks Super Admins out of their organiza
Unauthenticated job ID enumeration in Cap-go (Capgo) before version 12.128.2 exposes internal builder job identifiers vi
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today