CVE-2026-56082: Capgo Auth Bypass Vulnerability

CVE-2026-56082 Overview

CVE-2026-56082 is an improper access control vulnerability [CWE-284] in Capgo (Cap-go/capgo) versions prior to 12.128.2. The flaw resides in the SECURITY DEFINER PostgREST RPC function public.record_build_time, which is granted to the anon role. An unauthenticated attacker holding only the public Supabase publishable (sb_publishable_*) anon key can invoke the function and insert or overwrite rows in public.build_logs for arbitrary organizations. The function's ON CONFLICT (build_id, org_id) DO UPDATE clause enables cross-tenant tampering of billing build logs and inflation of billable build time.

Critical Impact
Unauthenticated attackers can tamper with cross-tenant billing records and inflate billable build time, producing financial-impact denial of service against arbitrary Capgo organizations.

Affected Products

Capgo (Cap-go/capgo) versions before 12.128.2
Self-hosted Capgo deployments exposing the Supabase PostgREST endpoint
Capgo tenants relying on the default anon role grants for public.record_build_time

Discovery Timeline

2026-06-19 - CVE-2026-56082 published to the National Vulnerability Database
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2026-56082

Vulnerability Analysis

The vulnerability stems from exposing a privileged database routine to anonymous callers. Capgo defines public.record_build_time as a PostgreSQL SECURITY DEFINER function, meaning it executes with the privileges of its owner rather than the caller. The function is granted EXECUTE to the anon role, which Supabase ties to the public publishable key shipped to client applications.

Because Supabase publishable keys are designed to be embedded in clients, any unauthenticated network user can reach the PostgREST endpoint and invoke the RPC. The function accepts an organization identifier and build identifier as parameters and writes directly to public.build_logs without verifying that the caller is a member of the target organization.

The ON CONFLICT (build_id, org_id) DO UPDATE clause compounds the issue. An attacker who reuses an existing build_id for a target org_id overwrites the prior usage record, replacing legitimate metering data with attacker-controlled values used for billing.

Root Cause

The root cause is a missing authorization check inside a SECURITY DEFINER function exposed to the anon role. The routine trusts caller-supplied org_id values and performs no validation against the JWT or session context, violating tenant isolation guarantees expected of multi-tenant Supabase backends.

Attack Vector

Exploitation occurs entirely over the network without authentication or user interaction. An attacker retrieves the public sb_publishable_* anon key from the Capgo web client, then issues an HTTP POST to the PostgREST RPC endpoint /rest/v1/rpc/record_build_time with an arbitrary org_id and a chosen build_id and duration. Repeated calls with the same build_id overwrite billing records for the targeted tenant. Refer to the GitHub Security Advisory and the VulnCheck Advisory on Supabase for technical specifics.

Detection Methods for CVE-2026-56082

Indicators of Compromise

Unexpected inserts or updates to public.build_logs originating from the anon role in PostgreSQL logs.
Repeated PostgREST requests to /rest/v1/rpc/record_build_time from a single source IP or unauthenticated session.
build_logs rows whose org_id does not correspond to the authenticated session that initiated the build.
Sudden spikes in recorded build duration or billing totals inconsistent with CI activity.

Detection Strategies

Enable PostgreSQL statement logging for the anon role and alert on calls to record_build_time.
Cross-reference build_logs entries with CI pipeline records to identify orphaned or duplicated build_id values.
Inspect Supabase API gateway logs for high-volume RPC calls from non-application source IPs.

Monitoring Recommendations

Forward PostgREST and PostgreSQL audit logs to a centralized analytics platform for correlation across tenants.
Establish baselines for per-organization build volumes and alert on deviations.
Monitor billing reconciliation jobs for anomalies that suggest record overwrites.

How to Mitigate CVE-2026-56082

Immediate Actions Required

Upgrade Capgo to version 12.128.2 or later, which removes the unsafe grants and adds tenant validation.
Revoke EXECUTE on public.record_build_time from the anon role until the patch is applied.
Rotate the Supabase publishable anon key if abuse is suspected, and audit build_logs for tampered rows.

Patch Information

Capgo addressed the vulnerability in release 12.128.2. The fix restricts public.record_build_time so it can no longer be invoked by the anon role and validates that the caller belongs to the supplied org_id. See the GitHub Security Advisory GHSA-42xj-3h9w-26h5 for upgrade instructions.

Workarounds

Revoke EXECUTE on the function from anon and grant it only to authenticated roles bound to the correct organization.
Add a row-level security policy or in-function check that compares org_id against the JWT claim before writing to build_logs.
Place the PostgREST endpoint behind an authenticated gateway that strips anonymous traffic to the RPC path.

bash

# Configuration example: revoke anonymous access until patched
psql -c "REVOKE EXECUTE ON FUNCTION public.record_build_time(uuid, uuid, integer) FROM anon;"
psql -c "GRANT EXECUTE ON FUNCTION public.record_build_time(uuid, uuid, integer) TO authenticated;"