EUVD-2026-38431
GHSA-rp66-wcx8-j4pj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain public anon key from Capgo client
-
DeliverySend concurrent GET /rest/v1/audit_logs requests
-
ExploitPlanner executes costly logic before RLS rejection
-
Executionstatement_timeout 57014 saturates DB workers
-
PersistCascading HTTP 500s on /orgs and other endpoints
-
ImpactApplication-layer denial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires only that the target run a Capgo backend before 12.128.12 with the default audit_logs RLS policy reachable through Supabase PostgREST, and that the attacker possess the Supabase anon key, which is intentionally public and embedded in the Capgo client. No user interaction, no authenticated session, and no non-default configuration is needed; the limiting factors are network reachability of the PostgREST endpoint and whether an operator has placed a WAF or rate-limiter in front of /audit_logs. |
| Impact | The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N with VA:H accurately reflects a trivially reachable, high-availability-impact flaw: any client holding the publicly distributed anon key can issue the request, and concurrency amplifies the effect to unrelated endpoints. There is no EPSS or KEV signal provided, and no POC is referenced beyond the vendor's GHSA write-up, so real-world exploitation appears opportunistic rather than mass-automated today. Confidentiality and integrity are unaffected, so prioritization should be driven by how critical Capgo uptime is to dependent mobile apps; for hosted Capgo instances the risk is meaningful because the attack is one curl command, while self-hosters behind authenticated proxies may face lower exposure. |
| Exploit ScenarioDerived | An attacker extracts the publicly embedded Supabase anon key from any Capgo-powered mobile app or the Capgo web client, then scripts concurrent GET requests against https://<capgo-host>/rest/v1/audit_logs. Each request stalls until statement_timeout fires, and within seconds connection-pool and CPU pressure cause unrelated endpoints like /orgs to return HTTP 500, taking the update-delivery API offline for legitimate client devices. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 23, 2026
Unauthenticated denial of service in Cap-go capgo (capgo-backend) before 12.128.12 allows remote attackers to exhaust PostgreSQL resources by sending unfiltered queries to the public.audit_logs PostgREST endpoint using the public anon key. Because the query planner runs expensive logic before Row-Level Security rejection, repeated requests trigger statement timeouts (error 57014) and cascade into HTTP 500 failures on unrelated endpoints such as /orgs. No public exploit identified at time of analysis, though the technique is fully described in the GHSA advisory.
RemediationAI
Vendor-released patch: upgrade capgo-backend to 12.128.12 or later, as documented in GHSA-5vgv-rqj5-5748 (https://github.com/Cap-go/capgo/security/advisories/GHSA-5vgv-rqj5-5748) which rewrites the audit_logs RLS policy so the anon role is rejected before the expensive query plan executes. If immediate upgrade is not possible, revoke the anon role's SELECT privilege on public.audit_logs at the database level or block the /audit_logs PostgREST route at an upstream reverse proxy - both will break any legitimate anon-key consumer of that table and should be paired with monitoring for 57014 timeouts. Lowering PostgreSQL statement_timeout for the anon role and adding per-IP rate limiting on PostgREST will reduce blast radius but will not fully prevent the resource exhaustion under sustained concurrency.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Capgo is a self-hosted live-update backend for Capacitor mobile apps that exposes its PostgreSQL database through Supabase PostgREST. PostgREST translates HTTP requests into SQL and relies on PostgreSQL Row-Level Security (RLS) policies to gate row visibility for the anonymous JWT role. The audit_logs RLS policy was written so that PostgreSQL's planner evaluates costly join/filter logic before the RLS predicate filters out the anon role, meaning rejected queries still consume CPU and memory until the statement_timeout fires. This is a textbook CWE-400 Uncontrolled Resource Consumption issue, made worse because the anon key is by design public and the endpoint is reachable without authentication.
Know when Capgo gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Network-reachable PostgREST endpoint usable with the public anon key, no auth or interaction, only availability impacted via DB resource exhaustion.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Cap-go capgo (capgo-backend) before 12.128.12 contains an unauthenticated denial-of-service vulnerability arising from the audit_logs table's Row-Level Security (RLS) policy when accessed via the Supabase PostgREST API. Because the PostgreSQL query planner executes costly logic before RLS rejection, unfiltered queries to the public.audit_logs endpoint using the public anon key consistently trigger statement timeouts (PostgREST error 57014). Under concurrency, this exhausts database resources and causes cascading HTTP 500 failures on unrelated endpoints (e.g. /orgs), resulting in an application-layer denial of service.
Executive ViewAI
Cap-go capgo-backend contains a remotely-exploitable vulnerability allowing attackers to disable application services and customer-facing systems through an unauthenticated denial-of-service attack. Versions prior to 12.128.12 are affected; no public exploit identified at time of analysis, but the attack mechanism is straightforward and documented in security advisories. This represents a material availability risk requiring urgent mitigation while awaiting vendor patch delivery.
No vendor-released patch identified at time of analysis. Implement network-level rate limiting and IP-based access restrictions on the public.audit_logs PostgREST endpoint; configure statement timeout thresholds (recommended: 5-30 seconds) to minimize cascading failures; deploy Web Application Firewall rules to block repetitive query patterns; restrict endpoint access to authenticated users or internal networks only; establish alert thresholds for PostgreSQL error 57014 (statement timeout) for rapid incident response.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Account pre-registration hijack in Capgo before 12.128.2 lets a remote unauthenticated attacker claim an account under a
Cross-domain SSO account takeover in Capgo before 12.128.2 allows an attacker with enterprise org admin access and a mal
Authentication bypass in Capgo prior to version 12.128.2 lets attackers defeat email-based OTP verification by tampering
Authentication bypass in Capgo before 12.128.2 lets remote unauthenticated attackers mint arbitrary API keys by tamperin
Rate-limit bypass in Capgo versions prior to 12.128.2 lets remote unauthenticated attackers flood the channel_self endpo
Cross-tenant data poisoning in Supabase Capgo before 12.128.2 allows remote unauthenticated attackers to corrupt billing
Server-side privilege escalation in Capgo before 12.128.2 lets authenticated users holding build permissions abuse a pat
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers query the /functions/v1/channel_se
Unauthenticated information disclosure in Capgo before 12.128.2 exposes confidential business metrics through the Supaba
Account takeover in Capgo before 12.128.2 stems from a password-change endpoint that omits current-password validation (
Information disclosure in Capgo (Capacitor live-update/OTA platform) before 12.128.2 lets unauthenticated callers abuse
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers read organization RBAC role bindin
Exploit-DB