Capgo CVE-2026-56311

No authentication is required - the attack leverages only the public Supabase anon key, which is a non-secret, client-embeddable credential by design in the Supabase architecture. The CVSS vector PR:N confirms this. The sole practical prerequisite is knowledge of a valid target organization UUID; random v4 UUIDs are not trivially guessable, so an attacker without prior UUID enumeration capability faces meaningful friction. Exploitation is strictly read-only and limited to billing plan metadata (MAU, bandwidth, storage, build time limits) - it does not grant access to application data, user records, or authentication tokens. The vulnerability does not affect organizations whose UUIDs cannot be obtained or inferred through other means.

The CVSS 4.0 score of 6.9 with vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N accurately reflects that the attack is trivially executable over the network without authentication, but impact is bounded to low confidentiality - billing plan metadata only, not credentials or application data. No EPSS score was provided in the input, preventing probabilistic exploitation comparison. The absence of a CISA KEV listing and no identified public exploit code together suggest this has not been actively weaponized at scale. Real-world risk is primarily business intelligence exposure - competitors or reconnaissance actors could enumerate organization resource tiers - rather than a path to system compromise or account takeover. The combination of PR:N and AC:L means any motivated actor can exploit this trivially if they can obtain or enumerate organization UUIDs, which is the only practical friction in the attack path.

An attacker retrieves Capgo's public Supabase anon key - which is by design embeddable in client apps and may be found in mobile app bundles, JavaScript sources, or public documentation - then crafts an HTTP POST to the Supabase RPC endpoint public.get_current_plan_max_org supplying a target organization's UUID as the parameter. The server returns the organization's billing plan metadata including MAU, bandwidth, storage, and build time limits without verifying the caller's relationship to that organization. If organization UUIDs are discoverable through other API responses or registration flows, the attacker can enumerate plan data across all Capgo tenants.