EUVD-2026-42253
GHSA-9wm3-r7wr-vg47
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with no auth (public key is not a secret); low confidentiality impact as only usage metrics are exposed, no integrity or availability impact.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
2DescriptionCVE.org
Capgo (Cap-go/capgo) before 12.128.2 contains an information disclosure vulnerability in the Supabase PostgREST RPC function public.get_total_metrics(org_id), which is callable by the anon role using only the public sb_publishable_* key. An unauthenticated attacker can probe organization existence and leak sensitive usage metrics including MAU, bandwidth, and install counts by sending POST requests to /rest/v1/rpc/get_total_metrics with valid organization UUIDs.
AnalysisAI
Unauthenticated information disclosure in Capgo (Cap-go/capgo) before 12.128.2 exposes sensitive organization metrics through a misconfigured Supabase PostgREST RPC endpoint. The Supabase function public.get_total_metrics(org_id) is accessible to the anon role using only the publicly distributed sb_publishable_* key, meaning any external party can query it without credentials. By iterating valid organization UUIDs against POST /rest/v1/rpc/get_total_metrics, attackers can confirm organization existence and harvest usage data including monthly active users, bandwidth consumption, and install counts. No public exploit or CISA KEV listing exists at time of analysis; the EPSS signal is absent from provided data but the low exploitation complexity suggests elevated opportunistic risk.
Technical ContextAI
Capgo is a live-update delivery platform for Capacitor-based mobile apps, built atop Supabase - an open-source Firebase alternative that exposes PostgreSQL via the PostgREST HTTP API. PostgREST maps database functions to REST endpoints under /rest/v1/rpc/. The anon role is Supabase's unauthenticated database role, intended only for truly public data; when a function like public.get_total_metrics is granted EXECUTE to anon without row-level security restrictions, any caller possessing the publishable API key (which is embedded in client applications and therefore not secret) can invoke it. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) captures the root cause: a missing access-control check at the database function layer allows data enumeration that should be restricted to authenticated organization members. The affected version range is capgo 0 through less than 12.128.2, per EUVD-2026-42253.
RemediationAI
Upgrade Capgo to version 12.128.2 or later, which is the vendor-confirmed patched release per the advisory at https://github.com/Cap-go/capgo/security/advisories/GHSA-h5jf-xgvh-hgjw. The fix presumably revokes EXECUTE privileges on public.get_total_metrics from the anon role or adds row-level security policies requiring authentication. As a compensating control for operators who cannot immediately upgrade, EXECUTE on the function should be revoked from the anon role in the Supabase dashboard using 'REVOKE EXECUTE ON FUNCTION public.get_total_metrics(uuid) FROM anon;' - note this will break any legitimate unauthenticated use of that endpoint, which should be assessed against actual application needs. Alternatively, restricting API gateway access to /rest/v1/rpc/get_total_metrics by IP allowlist or requiring a valid JWT (authenticated session) at the API gateway level will prevent anonymous invocation, though this requires infrastructure-layer controls not available in all Supabase deployment configurations.
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today