CVE-2026-56213: Capgo Authorization Bypass Vulnerability

CVE-2026-56213 Overview

CVE-2026-56213 is an authorization bypass vulnerability in Capgo versions prior to 12.128.2. The flaw resides in the public.upsert_version_meta SECURITY DEFINER function exposed through PostgREST Remote Procedure Call (RPC). Unauthenticated attackers can insert arbitrary rows into the version_meta table for any app_id by calling the RPC endpoint with a public anon key. Successful exploitation poisons storage metrics across tenants, producing persistent false data in dashboards and triggering incorrect alerts in victim applications. The weakness is classified as Missing Authorization [CWE-862].

Critical Impact
Unauthenticated attackers can poison cross-tenant storage metrics and trigger false dashboard alerts in any Capgo deployment running a version before 12.128.2.

Affected Products

Capgo versions prior to 12.128.2
Deployments exposing the public.upsert_version_meta function via PostgREST RPC
Capgo instances using a public anon key with default Row Level Security configuration

Discovery Timeline

2026-06-20 - CVE-2026-56213 published to the National Vulnerability Database (NVD)
2026-06-22 - Last updated in the NVD database

Technical Details for CVE-2026-56213

Vulnerability Analysis

The vulnerability is an authorization bypass in a PostgreSQL function deployed with the SECURITY DEFINER attribute. Functions defined with SECURITY DEFINER execute with the privileges of the function owner rather than the calling user. When such a function is exposed through PostgREST RPC without internal authorization checks, any caller — including holders of the public anon key — inherits the owner's data modification rights.

In Capgo before 12.128.2, the public.upsert_version_meta function performs writes to the version_meta table without verifying that the caller is authorized to operate on the supplied app_id. The downstream impact is integrity loss across tenant boundaries: storage metrics are aggregated from version_meta, so injected rows corrupt dashboards and alerting logic.

Root Cause

The root cause is missing authorization inside a privileged database function [CWE-862]. The SECURITY DEFINER function does not validate that the requesting principal owns the app_id parameter, and Row Level Security policies on version_meta are bypassed because the function runs as its definer.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker discovers the Capgo PostgREST endpoint, obtains the publicly available anon key, and issues an HTTP POST to the /rpc/upsert_version_meta route with a JSON body specifying an arbitrary app_id and crafted metric fields. The database executes the insert as the function owner, persisting attacker-controlled rows in another tenant's metrics. Repeated calls allow sustained metric poisoning.

No verified proof-of-concept code is published. Refer to the GitHub Security Advisory and Vulncheck Security Advisory for vendor technical detail.

Detection Methods for CVE-2026-56213

Indicators of Compromise

Unexpected INSERT or UPDATE operations on the version_meta table originating from the anon role
HTTP requests to /rpc/upsert_version_meta from unfamiliar source IP addresses or user agents
Spikes or implausible values in storage metrics dashboards that do not correlate with application traffic
Alert storms triggered by metric thresholds without matching application activity

Detection Strategies

Enable PostgreSQL statement logging for calls to public.upsert_version_meta and correlate caller role with expected service accounts
Inspect PostgREST access logs for POST /rpc/upsert_version_meta requests authenticated with the anon JWT
Compare version_meta row counts and timestamps against the application's actual release and upload events

Monitoring Recommendations

Forward PostgreSQL and PostgREST logs to a centralized analytics platform and alert on anon-role RPC writes
Baseline normal metric ingestion volume per app_id and alert on deviation
Audit all SECURITY DEFINER functions for missing authorization checks on a recurring schedule

How to Mitigate CVE-2026-56213

Immediate Actions Required

Upgrade Capgo to version 12.128.2 or later in all environments
Rotate the public anon key after patching to invalidate any keys captured by attackers
Audit the version_meta table for rows inserted before the upgrade and remove illegitimate entries
Review other SECURITY DEFINER functions for equivalent missing authorization patterns

Patch Information

The vendor fix is available in Capgo 12.128.2. The patched upsert_version_meta function enforces authorization on the supplied app_id before performing the upsert. Patch details are published in the GitHub Security Advisory GHSA-g4hx-x8gc-x6rw.

Workarounds

Revoke EXECUTE permission on public.upsert_version_meta from the anon and authenticated roles until the upgrade is applied
Remove the function from the PostgREST exposed schema to block RPC access
Place the PostgREST endpoint behind an authenticating reverse proxy that rejects anon-role calls to the affected RPC

bash

# Revoke RPC access to the vulnerable function as a temporary mitigation
REVOKE EXECUTE ON FUNCTION public.upsert_version_meta FROM anon, authenticated;
NOTIFY pgrst, 'reload schema';