EUVD-2026-38166
GHSA-7vcj-gm5g-5g9p
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable Supabase RPC (AV:N), trivial call (AC:L), any authenticated/anon role suffices (PR:L), no UI; integrity high (billing manipulation across tenants), confidentiality/availability low.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Capgo before 12.128.2 contains a potential privilege escalation vulnerability in the public.apply_usage_overage SECURITY DEFINER function, which performs sensitive billing operations without enforcing internal authorization checks (no validation of auth.uid(), org membership, or check_min_rights). Because the function runs with the owner's privileges, it bypasses Row Level Security. If EXECUTE permission is available to the authenticated or anon roles (explicitly or via default privileges), an authenticated user could invoke it via Supabase RPC to manipulate billing data for arbitrary organizations, including unauthorized credit depletion and fraudulent overage event insertion.
AnalysisAI
Privilege escalation in Capgo before 12.128.2 allows authenticated Supabase users to manipulate billing data for arbitrary organizations by invoking the public.apply_usage_overage SECURITY DEFINER function via RPC. The function executes with owner privileges and skips auth.uid(), org membership, and check_min_rights validation, bypassing Row Level Security and enabling fraudulent overage insertion or credit depletion across tenants. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires (1) network reachability to the Capgo project's Supabase PostgREST endpoint, (2) a valid Supabase session token for the authenticated role - or any session for the anon role if anon was granted EXECUTE - and (3) EXECUTE on public.apply_usage_overage granted to authenticated/anon, either explicitly or via PostgreSQL default privileges (the default Supabase pattern). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L (base 7.2) is consistent with the description: a network-reachable Supabase RPC endpoint, low attack complexity, low privileges (any authenticated or even anon role with EXECUTE), no user interaction, and high integrity impact on billing data. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers a normal Capgo account, obtains a Supabase JWT, and issues a POST to /rest/v1/rpc/apply_usage_overage with a target organization ID and arbitrary overage values. Because the SECURITY DEFINER function runs as the schema owner and performs no auth.uid()/org-membership check, the RPC inserts fraudulent overage events and depletes credits on a victim tenant. … |
| Remediation | Vendor-released patch: upgrade Capgo to 12.128.2 or later, which adds internal authorization checks to apply_usage_overage; the fix is described in the Capgo GHSA-qq85-vjrq-m75g advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: determine current Capgo version in production and search transaction logs for suspicious billing modifications in the past 30 days. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Authentication bypass in Capgo before 12.128.2 lets remote unauthenticated attackers mint arbitrary API keys by tamperin
Cross-domain SSO account takeover in Capgo before 12.128.2 allows an attacker with enterprise org admin access and a mal
Account pre-registration hijack in Capgo before 12.128.2 lets a remote unauthenticated attacker claim an account under a
Authentication bypass in Capgo prior to version 12.128.2 lets attackers defeat email-based OTP verification by tampering
Rate-limit bypass in Capgo versions prior to 12.128.2 lets remote unauthenticated attackers flood the channel_self endpo
Cross-tenant data poisoning in Supabase Capgo before 12.128.2 allows remote unauthenticated attackers to corrupt billing
Server-side privilege escalation in Capgo before 12.128.2 lets authenticated users holding build permissions abuse a pat
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers query the /functions/v1/channel_se
Account takeover in Capgo before 12.128.2 stems from a password-change endpoint that omits current-password validation (
Information disclosure in Capgo (Capacitor live-update/OTA platform) before 12.128.2 lets unauthenticated callers abuse
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers read organization RBAC role bindin
Cross-tenant authorization bypass in Capgo before 12.128.2 lets authenticated users impersonate another tenant's limited
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today