Capgo CVE-2026-56333

Exploitation requires an active authenticated session with organization administrator-level privileges within the target Capgo tenant - regular org members without admin rights cannot perform the direct table write. The attacker must have sufficient knowledge of the public.orgs table schema and Supabase API mechanics to craft a direct write request bypassing the application UI. Exploitation is strictly scoped to the attacker's own organization: cross-org data access or privilege escalation to other tenants is not enabled by this vulnerability. The attack cannot be performed by unauthenticated users or non-admin org members. Specific security-sensitive fields confirmed as exploitable include max_apikey_expiration_days; other configuration parameters in the public.orgs table may also lack server-side validation.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) scores 5.3 (Medium), reflecting network-accessible exploitation with low privileges and low integrity impact. Real-world risk is materially lower than a code execution or data exfiltration finding. The impact is confined to policy integrity: a rogue or compromised org admin can set values outside intended policy bounds, such as indefinitely long API key expiration windows, creating compliance drift or enabling long-lived credentials that evade governance controls. No EPSS data was provided in the intelligence feed, so probabilistic exploitation likelihood cannot be quantified. The vulnerability is not listed in CISA KEV, and no POC code has been publicly identified, suggesting exploitation has not been observed at scale. The primary risk is insider-threat or compromised-admin scenarios in regulated environments where API key governance is audited. The 'Information Disclosure' tag in the source intelligence appears inconsistent with the CVSS impact profile (VC:N), which shows no confidentiality impact - this discrepancy should be verified against the vendor advisory. The vendor's own CVSS 4.0 assessment uses PR:L; this analysis independently assesses PR:H given that org admin is an explicitly privileged application role.

An authenticated organization administrator opens browser developer tools or an API client and issues a direct Supabase REST or SDK call to write an arbitrary value - such as max_apikey_expiration_days set to 99999 - to the public.orgs table, bypassing the application UI's validation layer entirely. The server accepts the write because no server-side constraint rejects out-of-range values, leaving the organization's API key governance policy silently corrupted. No public exploit code has been identified at time of analysis, but the technique requires only standard browser tooling and knowledge of the Supabase table schema.