EUVD-2026-38166
GHSA-7vcj-gm5g-5g9p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRegister Capgo/Supabase account
-
DeliveryEnumerate target organization ID
-
ExploitCall apply_usage_overage RPC with victim org
-
ExecutionSECURITY DEFINER bypasses RLS checks
-
ImpactInsert fraudulent overage events and deplete credits
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires (1) network reachability to the Capgo project's Supabase PostgREST endpoint, (2) a valid Supabase session token for the authenticated role - or any session for the anon role if anon was granted EXECUTE - and (3) EXECUTE on public.apply_usage_overage granted to authenticated/anon, either explicitly or via PostgreSQL default privileges (the default Supabase pattern). The attacker must know or guess a victim organization identifier to pass as an argument. Exploitation is limited where operators have already revoked default grants on the function, where Capgo has been upgraded to 12.128.2+, or where network ACLs restrict the PostgREST endpoint to backend services only. |
| Impact | The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L (base 7.2) is consistent with the description: a network-reachable Supabase RPC endpoint, low attack complexity, low privileges (any authenticated or even anon role with EXECUTE), no user interaction, and high integrity impact on billing data. There is no EPSS, KEV, or SSVC data supplied, and no public PoC is referenced, so real-world exploitation pressure today appears low even though exploit construction is trivial once an attacker has a Capgo account. The principal uncertainty is the actual grant state of EXECUTE on apply_usage_overage in a given deployment - the advisory says 'if EXECUTE permission is available to the authenticated or anon roles (explicitly or via default privileges)', meaning hardened installations that revoked default PUBLIC/authenticated grants may not be exploitable; this should be verified per-deployment with information_schema.role_routine_grants. |
| Exploit ScenarioDerived | An attacker registers a normal Capgo account, obtains a Supabase JWT, and issues a POST to /rest/v1/rpc/apply_usage_overage with a target organization ID and arbitrary overage values. Because the SECURITY DEFINER function runs as the schema owner and performs no auth.uid()/org-membership check, the RPC inserts fraudulent overage events and depletes credits on a victim tenant. No public exploit is identified at time of analysis, but the call shape is trivially derivable from the function signature. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 22, 2026
Privilege escalation in Capgo before 12.128.2 allows authenticated Supabase users to manipulate billing data for arbitrary organizations by invoking the public.apply_usage_overage SECURITY DEFINER function via RPC. The function executes with owner privileges and skips auth.uid(), org membership, and check_min_rights validation, bypassing Row Level Security and enabling fraudulent overage insertion or credit depletion across tenants. No public exploit identified at time of analysis, but vendor and VulnCheck have published advisories and a patched release.
RemediationAI
Vendor-released patch: upgrade Capgo to 12.128.2 or later, which adds internal authorization checks to apply_usage_overage; the fix is described in the Capgo GHSA-qq85-vjrq-m75g advisory. As an immediate compensating control for operators who cannot upgrade right away, revoke EXECUTE on public.apply_usage_overage(...) from the anon and authenticated roles (and from PUBLIC) in the Supabase database - this breaks any application code path that legitimately calls the RPC from the client, so call sites should be moved server-side or wrapped in a vetted RPC. Alternatively, redefine the function as SECURITY INVOKER (which restores Row Level Security enforcement but will break it unless billing tables grant the caller appropriate access) or add an explicit guard at the top of the function that calls check_min_rights and validates auth.uid() against organization membership before mutating billing rows. Audit billing tables (overage events, credit balances) for anomalous cross-organization writes prior to the upgrade window.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Capgo is a self-hostable live-update / OTA delivery platform for Capacitor mobile apps that uses Supabase (PostgreSQL + PostgREST) as its backend. The flaw lives in a PostgreSQL SECURITY DEFINER function (public.apply_usage_overage) - a construct that executes with the privileges of the function's owner rather than the caller, which is precisely what defeats Supabase Row Level Security if the function does not re-implement its own authorization. Per the affected CPE cpe:2.3:a:capgo:capgo:*:*:*:*:*:*:*:*, all Capgo versions prior to 12.128.2 are affected. The root cause maps to CWE-269 (Improper Privilege Management): the definer-rights function trusts its caller and the PostgREST/RPC exposure path instead of validating auth.uid(), organization membership, or minimum-rights checks before mutating billing state.
Know when Capgo gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N
Network-reachable Supabase RPC (AV:N), trivial call (AC:L), any authenticated/anon role suffices (PR:L), no UI; integrity high (billing manipulation across tenants), confidentiality/availability low.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
Capgo before 12.128.2 contains a potential privilege escalation vulnerability in the public.apply_usage_overage SECURITY DEFINER function, which performs sensitive billing operations without enforcing internal authorization checks (no validation of auth.uid(), org membership, or check_min_rights). Because the function runs with the owner's privileges, it bypasses Row Level Security. If EXECUTE permission is available to the authenticated or anon roles (explicitly or via default privileges), an authenticated user could invoke it via Supabase RPC to manipulate billing data for arbitrary organizations, including unauthorized credit depletion and fraudulent overage event insertion.
Executive ViewAI
Capgo billing management system prior to version 12.128.2 contains a privilege escalation vulnerability allowing authenticated users to fraudulently modify billing data across any customer organization. Attackers could arbitrarily insert usage overages or deplete customer credits, directly compromising billing accuracy and revenue integrity for all Capgo users. This represents a material financial fraud risk affecting multi-tenant billing operations.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Cross-domain SSO account takeover in Capgo before 12.128.2 allows an attacker with enterprise org admin access and a mal
Authentication bypass in Capgo before 12.128.2 lets remote unauthenticated attackers mint arbitrary API keys by tamperin
Account pre-registration hijack in Capgo before 12.128.2 lets a remote unauthenticated attacker claim an account under a
Authentication bypass in Capgo prior to version 12.128.2 lets attackers defeat email-based OTP verification by tampering
Rate-limit bypass in Capgo versions prior to 12.128.2 lets remote unauthenticated attackers flood the channel_self endpo
Cross-tenant data poisoning in Supabase Capgo before 12.128.2 allows remote unauthenticated attackers to corrupt billing
Server-side privilege escalation in Capgo before 12.128.2 lets authenticated users holding build permissions abuse a pat
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers query the /functions/v1/channel_se
Account takeover in Capgo before 12.128.2 stems from a password-change endpoint that omits current-password validation (
Information disclosure in Capgo (Capacitor live-update/OTA platform) before 12.128.2 lets unauthenticated callers abuse
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers read organization RBAC role bindin
Cross-tenant authorization bypass in Capgo before 12.128.2 lets authenticated users impersonate another tenant's limited
Exploit-DB