CVE-2026-56214: Capgo Information Disclosure Vulnerability

CVE-2026-56214 Overview

CVE-2026-56214 is an information disclosure vulnerability in Capgo versions before 12.128.2. The flaw resides in two Supabase PostgREST Remote Procedure Call (RPC) endpoints: is_trial_org and is_paying_org. Unauthenticated attackers can invoke these endpoints using the public sb_publishable key to enumerate organizations and disclose their billing status. Distinguishable return values allow attackers to confirm organization existence and identify paying customers for targeted profiling, phishing, or social engineering campaigns. The vulnerability is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Unauthenticated remote attackers can enumerate Capgo organizations and identify paying customers without any authentication, enabling targeted attacks against high-value tenants.

Affected Products

Capgo (Cap-go/capgo) versions prior to 12.128.2
Supabase PostgREST RPC endpoints is_trial_org and is_paying_org
Deployments exposing the sb_publishable key to public clients

Discovery Timeline

2026-06-20 - CVE-2026-56214 published to NVD
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2026-56214

Vulnerability Analysis

The vulnerability stems from insufficient access control on two PostgREST RPC functions exposed through Supabase. Capgo exposes the sb_publishable key client-side, which is intended for public, low-risk operations. However, the is_trial_org and is_paying_org RPC endpoints accept unauthenticated calls using this key and return values that differentiate between existing and non-existing organizations.

Attackers can iterate through candidate organization identifiers and observe response patterns. A response indicating trial or paying status confirms the organization exists. A different response confirms non-existence. This oracle behavior turns the endpoints into enumeration primitives. Confirmed paying organizations represent high-value targets for follow-on attacks such as account takeover attempts, billing-related phishing, or competitive intelligence gathering.

Root Cause

The root cause is missing authorization on RPC functions that should require authenticated context. The functions execute under permissions accessible to the anon role through the public publishable key. PostgREST exposes any function granted to anon over HTTP, and Capgo did not restrict these specific functions to authenticated callers or apply Row Level Security (RLS) policies that would prevent enumeration.

Attack Vector

The attack vector is network-based and requires no authentication, privileges, or user interaction. An attacker sends crafted HTTP POST requests to the Supabase PostgREST endpoint for is_trial_org or is_paying_org, passing candidate organization identifiers as parameters along with the publicly known sb_publishable key in the apikey header. The response payload reveals whether the organization exists and whether it is a paying customer.

The vulnerability is described in prose only because no public proof-of-concept code is required to demonstrate it. The attack consists of standard HTTP requests against the documented PostgREST RPC interface. See the GitHub Security Advisory GHSA-mh5p-rrhp-442q and the VulnCheck Advisory for additional technical context.

Detection Methods for CVE-2026-56214

Indicators of Compromise

High-volume POST requests to PostgREST paths containing /rest/v1/rpc/is_trial_org or /rest/v1/rpc/is_paying_org
Requests using the sb_publishable key from a small set of source IP addresses iterating across many organization identifiers
Sequential or dictionary-style organization name parameters in RPC request bodies
Unusual spikes in anon role activity in Supabase logs

Detection Strategies

Enable PostgREST and Supabase request logging and alert on repeated calls to is_trial_org and is_paying_org from the same client
Establish rate baselines for RPC endpoints and trigger alerts when call rates exceed expected thresholds
Correlate RPC enumeration patterns with downstream phishing or credential-stuffing activity against the same organizations

Monitoring Recommendations

Forward Supabase audit logs and PostgREST access logs to a centralized SIEM for retention and analysis
Monitor for distributed enumeration attempts where many source IPs each issue a small number of RPC requests
Track outbound API responses for paying-status disclosures and review whether enumerated organizations subsequently experience targeted attacks

How to Mitigate CVE-2026-56214

Immediate Actions Required

Upgrade Capgo to version 12.128.2 or later, which removes anonymous access to the affected RPC functions
Revoke EXECUTE permissions on is_trial_org and is_paying_org from the anon PostgREST role
Rotate the sb_publishable key if abuse is suspected and audit recent PostgREST RPC activity
Review all other RPC functions exposed to the anon role for similar enumeration risks

Patch Information

The maintainers fixed the issue in Capgo 12.128.2. Refer to the GitHub Security Advisory GHSA-mh5p-rrhp-442q for patch details and the corresponding commits.

Workarounds

Restrict is_trial_org and is_paying_org to the authenticated role only and require a valid user session
Apply Row Level Security policies on referenced tables so anonymous callers cannot derive existence from response values
Modify the RPC functions to return uniform responses that do not distinguish between existing and non-existing organizations
Place a reverse proxy or Web Application Firewall in front of PostgREST to rate-limit and block enumeration patterns against these endpoints

bash

# Example: revoke anon access to the vulnerable RPC functions in PostgreSQL
REVOKE EXECUTE ON FUNCTION public.is_trial_org(text) FROM anon;
REVOKE EXECUTE ON FUNCTION public.is_paying_org(text) FROM anon;
GRANT EXECUTE ON FUNCTION public.is_trial_org(text) TO authenticated;
GRANT EXECUTE ON FUNCTION public.is_paying_org(text) TO authenticated;