EUVD-2026-38100
GHSA-cmgw-4g6h-mpvm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessExtract sb_publishable key from Capgo client
-
DeliveryEnumerate candidate organization IDs
-
ExploitCall is_trial_org RPC unauthenticated
-
ExecutionCall is_paying_org RPC unauthenticated
-
PersistCompare distinguishable responses
-
ImpactCompile list of paying customers for targeted profiling
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires only network reachability to the affected Capgo Supabase project and possession of the sb_publishable (anon) key, which is publicly distributed inside Capgo client applications and is therefore not a meaningful secret. The vulnerable functions is_trial_org and is_paying_org must be present and granted to the anon role - the default state for Capgo deployments prior to 12.128.2. No authentication, user interaction, or non-default configuration is needed; the principal limit on exploitation is that impact is confined to disclosure of organization existence and paying/trial status (no integrity, availability, or direct account data), and attackers must already know or guess candidate organization identifiers to query. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N) and score of 8.7 correctly model trivial network reachability with no privileges or user interaction and a confidentiality-only impact, which matches the described oracle behaviour. Capgo is not listed in CISA KEV and no EPSS score or public PoC was supplied, so this should be treated as 'no public exploit identified at time of analysis' rather than active exploitation; the realistic risk is information leakage and follow-on social-engineering or competitive intelligence against Capgo's paying customers rather than direct system compromise. The 8.7 'high' rating is arguably aggressive for a pure enumeration/billing-status disclosure with no integrity or availability impact - defenders should weight it against the actual data exposed (organization existence + paying flag) rather than treating it as equivalent to an RCE of similar score. |
| Exploit ScenarioDerived | An attacker extracts the sb_publishable key from the Capgo client bundle or a public app, then scripts POST requests to /rest/v1/rpc/is_trial_org and /rest/v1/rpc/is_paying_org with candidate organization identifiers harvested from GitHub, app stores, or marketing pages. Distinguishable return values reveal which organization names actually exist on Capgo and which are paying customers, producing a target list for phishing, competitive intelligence, or follow-on account takeover attempts. No public exploit identified at time of analysis, but the request shape is trivial to reproduce from the advisory. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 20, 2026
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers enumerate organizations and reveal billing status by invoking the Supabase PostgREST RPC endpoints is_trial_org and is_paying_org with the publicly distributed sb_publishable key. The flaw is reachable directly over the network without credentials and produces distinguishable responses that identify paying customers, enabling targeted profiling; no public exploit identified at time of analysis.
RemediationAI
Upgrade Capgo to 12.128.2 or later, which per the GHSA-mh5p-rrhp-442q advisory restricts or removes anon access to the is_trial_org and is_paying_org RPCs (Vendor-released patch: 12.128.2). Operators who cannot upgrade immediately should revoke EXECUTE on these two functions from the anon role in Supabase (e.g. REVOKE EXECUTE ON FUNCTION public.is_trial_org, public.is_paying_org FROM anon, authenticated) and, if the functions are still required by the app, move the calls behind an authenticated edge function or service-role proxy - the trade-off is that any in-app feature that depended on a pre-login billing check will need to be refactored. Rotating the sb_publishable key is not an effective mitigation on its own because publishable keys are designed to be public; combine the upgrade or REVOKE with PostgREST request-rate limiting and review the Supabase logs for prior enumeration patterns against these RPC paths. Follow the advisories at https://github.com/Cap-go/capgo/security/advisories/GHSA-mh5p-rrhp-442q and https://www.vulncheck.com/advisories/capgo-unauthenticated-organization-enumeration-and-billing-status-disclosure-via-supabase-rpc.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Capgo is a live-update / over-the-air delivery service for Capacitor mobile apps that uses Supabase (PostgreSQL + PostgREST) as its backend. PostgREST exposes database functions as JSON-RPC endpoints, and Supabase distinguishes between a publishable (anon) key embedded in client apps and a service key kept server-side. The vulnerability is rooted in CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): the SQL functions is_trial_org and is_paying_org were callable by the anon role and returned values that varied with the existence and billing posture of the queried organization, turning a billing-state helper into an oracle. Because the sb_publishable key is, by design, shipped in client applications, any attacker who extracts it from the mobile/web bundle gains the same access as a legitimate end user - i.e., none of the row-level-security or function-grant assumptions stop unauthenticated probing.
Know when Capgo gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Unauthenticated network RPC calls using a publicly distributed key (AV:N/AC:L/PR:N/UI:N) leak organization existence and billing status only, so C:H with I:N/A:N and no scope change.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
Capgo before 12.128.2 contains an information disclosure vulnerability in Supabase PostgREST RPC endpoints is_trial_org and is_paying_org that allows unauthenticated attackers to enumerate organizations and disclose billing status using the public sb_publishable key. Attackers can invoke these endpoints to determine organization existence via distinguishable return values and identify paying customers for targeted profiling.
Executive ViewAI
Capgo prior to version 12.128.2 exposes an unauthenticated API flaw allowing remote attackers to discover organizations and identify paying versus trial customers, enabling competitive profiling and targeted customer mapping. This information disclosure requires no credentials and uses only publicly distributed API keys, exposing customer status information to anyone with network access.
Vendor-released patch: Upgrade to Capgo 12.128.2 or later.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Capgo Authentication and Authorization Flaws
View all 5Cross-domain SSO account takeover in Capgo before 12.128.2 allows an attacker with enterprise org admin access and a mal
Authentication bypass in Capgo before 12.128.2 lets remote unauthenticated attackers mint arbitrary API keys by tamperin
Account pre-registration hijack in Capgo before 12.128.2 lets a remote unauthenticated attacker claim an account under a
Authentication bypass in Capgo prior to version 12.128.2 lets attackers defeat email-based OTP verification by tampering
Rate-limit bypass in Capgo versions prior to 12.128.2 lets remote unauthenticated attackers flood the channel_self endpo
Cross-tenant data poisoning in Supabase Capgo before 12.128.2 allows remote unauthenticated attackers to corrupt billing
Server-side privilege escalation in Capgo before 12.128.2 lets authenticated users holding build permissions abuse a pat
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers query the /functions/v1/channel_se
Account takeover in Capgo before 12.128.2 stems from a password-change endpoint that omits current-password validation (
Information disclosure in Capgo (Capacitor live-update/OTA platform) before 12.128.2 lets unauthenticated callers abuse
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers read organization RBAC role bindin
Cross-tenant authorization bypass in Capgo before 12.128.2 lets authenticated users impersonate another tenant's limited
Exploit-DB