Which versions of Capgo are affected by CVE-2026-56303?

Capgo versions before 12.128.2 expose sensitive API key metadata (user IDs, organization scope, expiration dates) to unauthenticated attackers via a publicly accessible API endpoint.. A patch is available.

How to fix or mitigate CVE-2026-56303?

Within 24 hours: Identify all Capgo deployments and confirm versions in use; review access logs for suspicious /rest/v1/rpc/find_apikey_by_value requests. Within 7 days: If Capgo <12.128.2 is in production, isolate the PostgREST endpoint from untrusted networks via firewall or WAF rules, and rotate all active API keys. Within 30 days: Monitor Capgo release notes for patch availability (12.128.2 or later); plan and execute upgrade immediately upon release.

Capgo CVE-2026-56303

Q: What is the CVSS score of CVE-2026-56303?

CVE-2026-56303 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-43171 HIGH

Information Exposure (CWE-200)

2026-07-11 VulnCheck

GHSA-25wv-52pf-rghh

PostgreSQL Information Disclosure Capgo

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Unauthenticated network RPC call with low complexity (PR:N/UI:N/AC:L) discloses sensitive key metadata (C:H) with no integrity or availability impact and no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 11, 2026 - 15:01 EUVD

Analysis Generated

Jul 11, 2026 - 14:05 vuln.today

CVE Published

Jul 11, 2026 - 13:00 cve.org

HIGH 8.7

DescriptionCVE.org

Capgo before 12.128.2 contains an information disclosure vulnerability in the find_apikey_by_value PostgreSQL function marked SECURITY DEFINER and executable by the anon role. Unauthenticated attackers can call this function via the /rest/v1/rpc/find_apikey_by_value endpoint to retrieve sensitive API key metadata including user_id, mode, org scoping, and expiration details when supplied a valid key value.

AnalysisAI

Unauthenticated API key metadata disclosure in Capgo before 12.128.2 stems from the find_apikey_by_value PostgreSQL function being marked SECURITY DEFINER and granted to the anon role, allowing anyone to call it through the PostgREST endpoint /rest/v1/rpc/find_apikey_by_value. When supplied a valid key value, an attacker retrieves sensitive metadata about that key - user_id, mode, organization scoping, and expiration details - bypassing normal row-level security. Reported by VulnCheck with CVSS 4.0 8.7 (High); no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Capgo is a live/over-the-air update service for Capacitor mobile apps that uses a Supabase/PostgREST backend, exposing PostgreSQL functions as REST RPC endpoints. In this architecture, functions declared SECURITY DEFINER execute with the privileges of the function owner rather than the caller, deliberately bypassing Row-Level Security; when such a function is also GRANTed EXECUTE to the anon (unauthenticated) role, any internet client can invoke privileged database logic. Here find_apikey_by_value performs a lookup against the api_keys table and returns key metadata, so the SECURITY DEFINER context leaks data that RLS would otherwise protect. This maps to CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): the root cause is an over-privileged, over-exposed database function, not memory corruption or injection.

RemediationAI

Vendor-released patch: 12.128.2 - upgrade Capgo to 12.128.2 or later, which corrects the exposure of the find_apikey_by_value RPC. As a compensating control before or instead of upgrading, revoke EXECUTE on find_apikey_by_value from the anon (and where appropriate authenticated) role in PostgreSQL, or drop the SECURITY DEFINER attribute so the function runs with caller privileges and RLS applies; the trade-off is that any application flow legitimately relying on anonymous key lookups will break until refactored to a server-side authenticated path. Additionally, restrict network access to the PostgREST /rest/v1/rpc/ endpoint at the gateway/reverse proxy and rotate any API keys whose metadata may have been queried. Follow the remediation guidance in GHSA-2xjq-h43m-592f (https://github.com/Cap-go/capgo/security/advisories/GHSA-2xjq-h43m-592f) and the VulnCheck advisory (https://www.vulncheck.com/advisories/capgo-unauthenticated-api-key-metadata-disclosure-via-security-definer-rpc-function).