Which versions of Capgo are affected by CVE-2026-56248?

Cap-go capgo-backend contains a remotely-exploitable vulnerability allowing attackers to disable application services and customer-facing systems through an unauthenticated denial-of-service attack.. A patch is available.

How to fix or mitigate CVE-2026-56248?

24 hours: Inventory all Cap-go capgo-backend instances and identify those running versions before 12.128.12; enable detailed logging and monitoring on the public.audit_logs PostgREST endpoint for anomalous query patterns. 7 days: Implement rate limiting on the audit_logs endpoint (10 requests/minute per IP recommended), restrict network access to the PostgREST service to trusted networks, and configure aggressive PostgreSQL statement timeouts. 30 days: Monitor vendor advisories for patch availability; establish upgrade path to version 12.128.12 or later and coordinate deployment with application teams.

Capgo CVE-2026-56248

Q: What is the CVSS score of CVE-2026-56248?

CVE-2026-56248 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-38431 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-06-23 VulnCheck

GHSA-rp66-wcx8-j4pj

Denial Of Service PostgreSQL Cap Go Capgo

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Network-reachable PostgREST endpoint usable with the public anon key, no auth or interaction, only availability impacted via DB resource exhaustion.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 23, 2026 - 14:17 EUVD

Analysis Generated

Jun 23, 2026 - 13:04 vuln.today

CVE Published

Jun 23, 2026 - 12:12 cve.org

HIGH 8.7

DescriptionCVE.org

Cap-go capgo (capgo-backend) before 12.128.12 contains an unauthenticated denial-of-service vulnerability arising from the audit_logs table's Row-Level Security (RLS) policy when accessed via the Supabase PostgREST API. Because the PostgreSQL query planner executes costly logic before RLS rejection, unfiltered queries to the public.audit_logs endpoint using the public anon key consistently trigger statement timeouts (PostgREST error 57014). Under concurrency, this exhausts database resources and causes cascading HTTP 500 failures on unrelated endpoints (e.g. /orgs), resulting in an application-layer denial of service.

AnalysisAI

Unauthenticated denial of service in Cap-go capgo (capgo-backend) before 12.128.12 allows remote attackers to exhaust PostgreSQL resources by sending unfiltered queries to the public.audit_logs PostgREST endpoint using the public anon key. Because the query planner runs expensive logic before Row-Level Security rejection, repeated requests trigger statement timeouts (error 57014) and cascade into HTTP 500 failures on unrelated endpoints such as /orgs. No public exploit identified at time of analysis, though the technique is fully described in the GHSA advisory.

Technical ContextAI

Capgo is a self-hosted live-update backend for Capacitor mobile apps that exposes its PostgreSQL database through Supabase PostgREST. PostgREST translates HTTP requests into SQL and relies on PostgreSQL Row-Level Security (RLS) policies to gate row visibility for the anonymous JWT role. The audit_logs RLS policy was written so that PostgreSQL's planner evaluates costly join/filter logic before the RLS predicate filters out the anon role, meaning rejected queries still consume CPU and memory until the statement_timeout fires. This is a textbook CWE-400 Uncontrolled Resource Consumption issue, made worse because the anon key is by design public and the endpoint is reachable without authentication.

RemediationAI

Vendor-released patch: upgrade capgo-backend to 12.128.12 or later, as documented in GHSA-5vgv-rqj5-5748 (https://github.com/Cap-go/capgo/security/advisories/GHSA-5vgv-rqj5-5748) which rewrites the audit_logs RLS policy so the anon role is rejected before the expensive query plan executes. If immediate upgrade is not possible, revoke the anon role's SELECT privilege on public.audit_logs at the database level or block the /audit_logs PostgREST route at an upstream reverse proxy - both will break any legitimate anon-key consumer of that table and should be paired with monitoring for 57014 timeouts. Lowering PostgreSQL statement_timeout for the anon role and adding per-IP rate limiting on PostgREST will reduce blast radius but will not fully prevent the resource exhaustion under sustained concurrency.