EUVD-2026-38741Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable Supabase REST with any non-admin API key (PR:L, AC:L); secret disclosure gives C:H, forged webhooks give I:L, no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Capgo before 12.128.2 allows non-admin API keys to read webhook signing secrets via Supabase REST due to insufficient row-level security policies on the webhooks table. Attackers can retrieve the webhook secret and forge valid X-Capgo-Signature headers to send authenticated webhook events to configured receivers, breaking webhook authenticity and integrity.
AnalysisAI
Webhook signing secret disclosure in Capgo prior to 12.128.2 allows authenticated holders of non-admin API keys to read the webhook signing secret directly from the Supabase REST-exposed webhooks table because row-level security policies are too permissive. Once obtained, the secret lets the attacker forge valid X-Capgo-Signature headers and submit spoofed webhook events to any configured receiver, undermining webhook authenticity and integrity. No public exploit identified at time of analysis.
Technical ContextAI
Capgo is a CodePush-style live-update service for Capacitor mobile applications that uses Supabase (PostgreSQL with PostgREST) as its data layer. The flaw is a CWE-200 information disclosure rooted in misconfigured Supabase row-level security (RLS): the webhooks table grants SELECT access to the signing-secret column for API roles that should only have project- or app-scoped read access, rather than restricting it to admin/service-role tokens. Because PostgREST automatically exposes every readable column, an insufficiently scoped RLS policy is directly equivalent to a public read of that field for any holder of a non-admin API key.
RemediationAI
Vendor-released patch: upgrade Capgo to 12.128.2 or later, which tightens the row-level security policies on the webhooks table so that the signing secret is no longer readable via non-admin API keys; the advisory is published at https://github.com/Cap-go/capgo/security/advisories/GHSA-qrrx-x3qf-x87v. If immediate upgrade is not possible, rotate the webhook signing secret after patching (any pre-patch secret must be assumed leaked), revoke and reissue any non-admin API keys that may have queried the webhooks table, and as compensating controls tighten the Supabase RLS policy on the webhooks table to restrict SELECT on the secret column to the service_role only (side effect: any tooling using a non-admin key to introspect webhook configuration will break) and, on receivers, add IP allow-listing or mutual TLS in front of signature verification so a forged X-Capgo-Signature alone is insufficient.
Authentication bypass in Capgo before 12.128.2 lets remote unauthenticated attackers mint arbitrary API keys by tamperin
Cross-domain SSO account takeover in Capgo before 12.128.2 allows an attacker with enterprise org admin access and a mal
Account pre-registration hijack in Capgo before 12.128.2 lets a remote unauthenticated attacker claim an account under a
Authentication bypass in Capgo prior to version 12.128.2 lets attackers defeat email-based OTP verification by tampering
Rate-limit bypass in Capgo versions prior to 12.128.2 lets remote unauthenticated attackers flood the channel_self endpo
Cross-tenant data poisoning in Supabase Capgo before 12.128.2 allows remote unauthenticated attackers to corrupt billing
Server-side privilege escalation in Capgo before 12.128.2 lets authenticated users holding build permissions abuse a pat
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers query the /functions/v1/channel_se
Account takeover in Capgo before 12.128.2 stems from a password-change endpoint that omits current-password validation (
Information disclosure in Capgo (Capacitor live-update/OTA platform) before 12.128.2 lets unauthenticated callers abuse
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers read organization RBAC role bindin
Cross-tenant authorization bypass in Capgo before 12.128.2 lets authenticated users impersonate another tenant's limited
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today