CVE-2026-56235 Overview
CVE-2026-56235 is an authorization bypass vulnerability in Cap-go capgo versions before 12.128.2. The flaw resides in several Supabase PostgREST Remote Procedure Call (RPC) functions, specifically get_app_metrics, get_global_metrics, and get_total_metrics. These functions are granted to the anon role without enforcing organization membership or permission checks. An unauthenticated attacker using only the public Supabase API key (sb_publishable_*) can query arbitrary org_id values to disclose cross-tenant usage telemetry. The vulnerability is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.
Critical Impact
Unauthenticated attackers can disclose cross-tenant telemetry including Monthly Active Users (MAU), bandwidth, installs, and gets, enumerate app IDs, and confirm organization existence via an oracle response.
Affected Products
- Cap-go capgo versions before 12.128.2
- Supabase PostgREST RPC functions: get_app_metrics, get_global_metrics, get_total_metrics
- Deployments exposing the anon role to public Supabase API keys
Discovery Timeline
- 2026-06-20 - CVE-2026-56235 published to NVD
- 2026-06-24 - Last updated in NVD database
Technical Details for CVE-2026-56235
Vulnerability Analysis
The vulnerability stems from missing authorization checks on PostgREST RPC functions exposed via the Supabase API. The functions get_app_metrics, get_global_metrics, and get_total_metrics accept an org_id parameter from the caller. They return tenant-specific telemetry without validating whether the caller belongs to the requested organization. Because execution privileges are granted to the anon role, any client holding the publicly distributed sb_publishable_* key can invoke them.
The response behavior creates an enumeration oracle. A valid org_id returns metrics data, while an invalid value returns an empty array. Attackers can iterate through candidate identifiers to confirm organization existence and harvest per-tenant usage data.
Root Cause
The root cause is a missing access control on database-level RPC functions. The functions accept tenant identifiers as parameters but do not cross-reference the authenticated user context against organization membership tables. Granting EXECUTE to the anon role effectively makes the functions callable by any anonymous network client.
Attack Vector
The attack is remote and unauthenticated. The attacker obtains the public Supabase API key, which is intentionally exposed in client-side capgo deployments. Using this key, the attacker issues HTTP POST requests to the PostgREST RPC endpoints with chosen org_id values. The server returns metrics for any organization the attacker queries. Repeated requests allow enumeration of valid organizations, discovery of associated app identifiers, and extraction of MAU, bandwidth, install, and get counters. No user interaction or elevated privileges are required.
Technical details are documented in the GitHub Security Advisory GHSA-gfpq-vphf-6gcm and the VulnCheck Advisory.
Detection Methods for CVE-2026-56235
Indicators of Compromise
- Anonymous PostgREST requests to /rest/v1/rpc/get_app_metrics, /rest/v1/rpc/get_global_metrics, or /rest/v1/rpc/get_total_metrics using sb_publishable_* keys.
- High request volume against RPC endpoints with iterating org_id UUID values from a single source IP.
- Mixed response patterns showing both populated metrics arrays and empty [] responses, suggesting org enumeration.
Detection Strategies
- Audit Supabase PostgREST logs for invocations of the affected RPC functions originating from the anon role.
- Correlate request rates per source IP and per org_id to identify systematic enumeration behavior.
- Inspect database GRANT statements to identify any RPC functions executable by anon without internal authorization checks.
Monitoring Recommendations
- Enable PostgREST query logging and forward logs to a SIEM for anomaly analysis.
- Set rate limits on RPC endpoints and alert on bursts exceeding baseline organization query patterns.
- Track outbound disclosure of org_id, app_id, MAU, and bandwidth fields in API responses to anonymous callers.
How to Mitigate CVE-2026-56235
Immediate Actions Required
- Upgrade Cap-go capgo to version 12.128.2 or later.
- Revoke EXECUTE privileges on get_app_metrics, get_global_metrics, and get_total_metrics from the anon role.
- Rotate the public Supabase API key if telemetry disclosure has occurred and review access logs for prior abuse.
Patch Information
The fix is included in Cap-go capgo 12.128.2. The patched release adds organization membership and permission enforcement to the affected RPC functions. Refer to the GitHub Security Advisory GHSA-gfpq-vphf-6gcm for the upstream remediation details.
Workarounds
- Restrict the affected RPC functions to the authenticated role and add server-side checks validating auth.uid() against organization membership.
- Place a reverse proxy or Web Application Firewall (WAF) rule in front of PostgREST to block anonymous RPC calls until the upgrade is applied.
- Implement Row Level Security (RLS) policies on underlying metrics tables to enforce tenant isolation at the database layer.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
