Supabase Capgo EUVD-2026-38742

Exploitation requires only network reachability to the Capgo Supabase PostgREST endpoint (/rest/v1/rpc/record_build_time) and possession of the project's public anon API key, which is by design embedded in client apps and therefore not a meaningful secret. The vulnerable Capgo version must be prior to 12.128.2 with the SECURITY DEFINER record_build_time RPC granted to the anon role (the default configuration). No user interaction, no admin or tenant credentials, and no special platform are required; the only practical limiter is knowing or guessing target organization identifiers, which are typically enumerable.

The CVSS 4.0 vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L confirms a network-reachable, low-complexity, unauthenticated attack with high integrity impact on billing/quota data and limited availability impact through resource exhaustion - a realistic alignment with the description. No EPSS score, KEV listing, or POC was provided, so urgency is driven by exploit triviality rather than confirmed in-the-wild activity; absence of KEV status does not lower the underlying risk because the attack requires only a publicly distributed anon key and a single HTTP POST. Confidentiality is correctly rated N since the function writes rather than reads, but defenders should note the indirect financial and operational impact on SaaS tenants, which raw CVSS does not capture.

An attacker harvests the publicly embedded Supabase anon key from any Capgo-using mobile app or web client and issues repeated POST /rest/v1/rpc/record_build_time requests carrying inflated build durations against a competitor's organization ID. This poisons that tenant's quota counters until builds are rejected for over-quota and inflates the victim's invoice, while the attacker pays nothing and remains unauthenticated.