EUVD-2026-43223
GHSA-4wq7-w2m9-cfmm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain public Supabase anon apikey
-
ExploitQuery /rest/v1/global_stats endpoint
-
ExecutionPostgREST returns unprotected rows
-
ImpactExfiltrate MRR and revenue metrics
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the target to be running Capgo before 12.128.2 with the Supabase PostgREST global_stats endpoint exposed and the anon role able to read it; the attacker needs only the public/anon Supabase apikey, which is embedded in Capgo client apps and thus not a meaningful secret. Per the CVSS vector (AV:N/AC:L/AT:N/PR:N/UI:N), there is no authentication, no user interaction, and no special attack requirement - remote unauthenticated access against affected default configurations. The main limiting factors are that the impact is read-only disclosure of aggregate business metrics (no write/RCE, VI:N/VA:N) and that the exposure exists only where the vulnerable global_stats endpoint/RLS misconfiguration is present, i.e., unpatched Capgo backends. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N) is internally consistent and describes a genuinely easy-to-reach exposure: network-reachable, low complexity, no privileges, no user interaction, high confidentiality impact and no integrity or availability impact - matching an unauthenticated read-only data leak. No EPSS score, KEV listing, POC, or SSVC decision data was provided, so exploitation likelihood cannot be quantified from the input; there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical risk is bounded by impact type - this leaks business intelligence (revenue, customer counts), not credentials, code execution, or user PII per the description - so it is a serious confidentiality/competitive-harm issue for the vendor rather than a mass-compromise threat. It should be prioritized as a real, easily exploitable data-exposure bug, but its real-world blast radius is limited by Capgo's niche deployment footprint. |
| Exploit ScenarioDerived | An attacker extracts the public Supabase anon apikey from a Capgo-enabled mobile app bundle or observed network traffic, then sends a single unauthenticated HTTP GET to /rest/v1/global_stats with that key. PostgREST returns the aggregate financial and operational metrics - MRR, total revenue, plan-tier breakdowns, and customer counts - giving a competitor or extortionist detailed business intelligence with no authentication and no user interaction. No public POC is identified, but the request is trivial to reproduce given the low attack complexity (AC:L). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 12, 2026
Unauthenticated information disclosure in Capgo before 12.128.2 exposes confidential business metrics through the Supabase PostgREST /rest/v1/global_stats endpoint, which lacks row-level security enforcement. Any remote party holding only the public (anon) Supabase apikey - a value embedded in Capgo client apps and therefore trivially obtainable - can read MRR, total and plan-tier revenue, customer counts, and operational telemetry. Reported by VulnCheck via a GitHub security advisory; no public exploit code or active exploitation has been identified at time of analysis, though the CVSS 4.0 score of 8.7 reflects high confidentiality impact with no barriers to access.
RemediationAI
Vendor-released patch: upgrade to Capgo 12.128.2 or later, which is the primary and authoritative fix per the GitHub advisory GHSA-73rv-fpp7-r3r4 (https://github.com/Cap-go/capgo/security/advisories/GHSA-73rv-fpp7-r3r4). If immediate upgrade is not possible, apply compensating controls at the Supabase layer: add or correct a Row-Level Security policy on the global_stats table/view to deny the 'anon' role (revoking the anon/public grant so PostgREST returns no rows), or drop the endpoint's exposure by removing global_stats from the exposed PostgREST schema - both eliminate the leak with the side effect of breaking any legitimate client feature that reads those aggregate stats. As a stopgap you can also restrict network access to the /rest/v1/global_stats path at a proxy/WAF, though this is weaker since the anon key is otherwise valid for other endpoints. Refer to the VulnCheck advisory (https://www.vulncheck.com/advisories/capgo-unauthenticated-information-disclosure-via-postgrest-global-stats-endpoint) for confirmation of scope.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Capgo is a live/over-the-air update platform for Capacitor (Ionic) mobile applications, and it uses Supabase - a hosted Postgres backend - with PostgREST automatically exposing database tables as REST endpoints. In this architecture, the 'anon' apikey is intentionally public and shipped inside client apps; access control is meant to be enforced by Postgres Row-Level Security (RLS) policies rather than by keeping the key secret. The root cause maps to CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): the global_stats table/view was reachable through PostgREST without an RLS policy restricting it to privileged roles, so presenting the anon key alone returned aggregate financial and operational data. The single affected product per the CPE (cpe:2.3:a:capgo:capgo:*) is the Capgo application/backend itself.
Know when Capgo gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Remote, unauthenticated, single-request read using a public key gives AV:N/AC:L/PR:N/UI:N; only confidentiality of business data is affected, so C:H with I:N/A:N and unchanged scope.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
Capgo before 12.128.2 contains an information disclosure vulnerability in the Supabase PostgREST global_stats endpoint that allows unauthenticated attackers to read sensitive financial and operational metrics using only the public apikey. Remote attackers can query the /rest/v1/global_stats endpoint to expose MRR, total revenue, plan-tier revenue breakdown, customer counts, and operational telemetry.
Executive ViewAI
Capgo versions before 12.128.2 expose sensitive business metrics-revenue, customer counts by plan tier, and operational data-without requiring authentication. Any external party can remotely access this data if they obtain the public API credentials embedded in Capgo client software. This represents a critical competitive intelligence leak compromising negotiation position and exposing operational vulnerabilities.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Cross-domain SSO account takeover in Capgo before 12.128.2 allows an attacker with enterprise org admin access and a mal
Authentication bypass in Capgo before 12.128.2 lets remote unauthenticated attackers mint arbitrary API keys by tamperin
Account pre-registration hijack in Capgo before 12.128.2 lets a remote unauthenticated attacker claim an account under a
Authentication bypass in Capgo prior to version 12.128.2 lets attackers defeat email-based OTP verification by tampering
Rate-limit bypass in Capgo versions prior to 12.128.2 lets remote unauthenticated attackers flood the channel_self endpo
Cross-tenant data poisoning in Supabase Capgo before 12.128.2 allows remote unauthenticated attackers to corrupt billing
Server-side privilege escalation in Capgo before 12.128.2 lets authenticated users holding build permissions abuse a pat
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers query the /functions/v1/channel_se
Account takeover in Capgo before 12.128.2 stems from a password-change endpoint that omits current-password validation (
Information disclosure in Capgo (Capacitor live-update/OTA platform) before 12.128.2 lets unauthenticated callers abuse
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers read organization RBAC role bindin
Cross-tenant authorization bypass in Capgo before 12.128.2 lets authenticated users impersonate another tenant's limited
Exploit-DB