EUVD-2026-38742Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network call to a public RPC (AV:N/AC:L/PR:N/UI:N); writes poison billing data (I:H) and enables quota exhaustion (A:L); no data disclosure (C:N).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Supabase Capgo before 12.128.2 contains an authorization bypass vulnerability in the SECURITY DEFINER record_build_time RPC function that allows unauthenticated attackers to insert arbitrary build-time records. Attackers can exploit this by calling POST /rest/v1/rpc/record_build_time with a public API key to poison billing and quota data for any organization, enabling resource exhaustion and cross-tenant billing manipulation.
AnalysisAI
Cross-tenant data poisoning in Supabase Capgo before 12.128.2 allows remote unauthenticated attackers to corrupt billing and quota records by invoking the SECURITY DEFINER record_build_time RPC with only a public anon API key. The flaw stems from missing authorization inside a privilege-elevated PostgREST function, enabling arbitrary build-time inserts against any organization. No public exploit identified at time of analysis, but the trivial network-reachable invocation pattern makes weaponization straightforward.
Technical ContextAI
Capgo is a Supabase-based live-update and CI/CD service for Capacitor mobile apps that exposes PostgreSQL functions through PostgREST at /rest/v1/rpc/. The vulnerable record_build_time function is declared SECURITY DEFINER, meaning it executes with the privileges of the owning role rather than the caller, so PostgreSQL Row-Level Security is bypassed unless the function body itself enforces tenant checks. CWE-269 (Improper Privilege Management) applies because the function trusts caller-supplied organization identifiers without verifying that the JWT role or org claim of the requester matches the target record, allowing the anon role to act as if it were any tenant.
RemediationAI
Vendor-released patch: upgrade Capgo to 12.128.2 or later as published in GHSA-42f8-v563-5763 (https://github.com/Cap-go/capgo/security/advisories/GHSA-42f8-v563-5763), which adds authorization enforcement inside the record_build_time function. If immediate upgrade is not possible, revoke EXECUTE on public.record_build_time from the anon and authenticated roles via PostgreSQL GRANT/REVOKE, accepting that legitimate build-time accounting from clients will stop until a fixed version is deployed; alternatively, front the PostgREST endpoint with a reverse proxy rule that blocks POST /rest/v1/rpc/record_build_time from unauthenticated callers, which has the same functional side effect. Operators should also audit the build_time table for anomalous inserts and reconcile billing/quota counters issued since the vulnerable function was deployed.
Authentication bypass in Capgo before 12.128.2 lets remote unauthenticated attackers mint arbitrary API keys by tamperin
Cross-domain SSO account takeover in Capgo before 12.128.2 allows an attacker with enterprise org admin access and a mal
Account pre-registration hijack in Capgo before 12.128.2 lets a remote unauthenticated attacker claim an account under a
Authentication bypass in Capgo prior to version 12.128.2 lets attackers defeat email-based OTP verification by tampering
Rate-limit bypass in Capgo versions prior to 12.128.2 lets remote unauthenticated attackers flood the channel_self endpo
Server-side privilege escalation in Capgo before 12.128.2 lets authenticated users holding build permissions abuse a pat
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers query the /functions/v1/channel_se
Account takeover in Capgo before 12.128.2 stems from a password-change endpoint that omits current-password validation (
Information disclosure in Capgo (Capacitor live-update/OTA platform) before 12.128.2 lets unauthenticated callers abuse
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers read organization RBAC role bindin
Cross-tenant authorization bypass in Capgo before 12.128.2 lets authenticated users impersonate another tenant's limited
Privilege escalation in Capgo before 12.128.2 lets an authenticated org admin assign org-scoped RBAC roles at the narrow
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today