CVE-2026-56238: Capgo Information Disclosure Vulnerability

CVE-2026-56238 Overview

CVE-2026-56238 is an information disclosure vulnerability in Capgo versions before 12.128.2. The flaw resides in the Supabase PostgREST global_stats endpoint, which exposes sensitive business metrics without authentication. Unauthenticated remote attackers can query /rest/v1/global_stats using only the public apikey to retrieve monthly recurring revenue (MRR), total revenue, plan-tier revenue breakdowns, customer counts, and operational telemetry. The vulnerability maps to CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Remote attackers can read confidential financial and operational data from Capgo deployments without credentials, using only the publicly distributed API key.

Affected Products

Capgo self-hosted deployments before version 12.128.2
Supabase PostgREST global_stats endpoint exposed on affected Capgo instances
Any downstream service relying on Capgo's PostgREST row-level security configuration prior to the patched release

Discovery Timeline

2026-07-12 - CVE-2026-56238 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-56238

Vulnerability Analysis

Capgo is an open-source live-update platform for Capacitor mobile applications and uses Supabase PostgREST to expose database views over HTTP. The global_stats view aggregates internal business metrics but was not restricted by row-level security (RLS) policies. As a result, PostgREST served the view to any client presenting the anon role apikey, which Capgo distributes with its public clients.

An attacker sending a single HTTP GET request to /rest/v1/global_stats with the public apikey header receives MRR, total revenue, revenue segmented by plan tier, customer counts, and operational telemetry. No user session, JWT, or elevated role is required. The disclosure is limited to confidentiality of business data — no integrity or availability impact was identified.

Root Cause

The root cause is a missing authorization control on the global_stats PostgREST endpoint [CWE-200]. Supabase treats the anon API key as a role selector rather than an authentication factor. Because the global_stats view was not protected by RLS or a SECURITY DEFINER guard, PostgREST returned aggregated financial data to any caller with the anon key.

Attack Vector

The attack is network-based and requires no privileges or user interaction. An attacker discovers the Capgo instance hostname and issues an HTTPS request to the PostgREST endpoint with the public apikey header. PostgREST responds with a JSON document containing the sensitive metrics. Refer to the GitHub Security Advisory GHSA-73rv-fpp7-r3r4 and the VulnCheck Security Advisory for technical details.

Detection Methods for CVE-2026-56238

Indicators of Compromise

HTTP GET requests to /rest/v1/global_stats on Capgo or Supabase PostgREST hosts from unexpected client IP ranges
Requests containing only the public anon apikey header without an accompanying Authorization: Bearer JWT
Elevated JSON response sizes from the global_stats endpoint indicating full metric enumeration

Detection Strategies

Enable PostgREST and reverse proxy access logging, then alert on any external access to /rest/v1/global_stats
Correlate apikey-only requests against expected internal service IP allowlists to surface unauthorized callers
Baseline query patterns against sensitive views and flag anonymous role access to revenue or customer-count columns

Monitoring Recommendations

Ship Supabase, PostgREST, and CDN logs to a centralized SIEM for retention and correlation
Create dashboards tracking request volume and unique source IPs hitting global_stats and other aggregate views
Configure alerts on the appearance of the anon apikey in requests originating outside expected client platforms

How to Mitigate CVE-2026-56238

Immediate Actions Required

Upgrade Capgo to version 12.128.2 or later, which restricts the global_stats endpoint
Rotate the Supabase anon and service_role API keys after upgrading to invalidate any keys captured by attackers
Audit PostgREST views and functions to confirm RLS policies deny anonymous access to sensitive aggregates

Patch Information

Capgo 12.128.2 remediates the issue by applying row-level security and role-based access controls to the global_stats view. Details are published in the GitHub Security Advisory GHSA-73rv-fpp7-r3r4. Operators of self-hosted Capgo deployments should apply the upstream database migration included in the release.

Workarounds

Revoke SELECT privileges on the global_stats view from the anon role until the patch is applied
Block external access to /rest/v1/global_stats at the reverse proxy or WAF layer
Restrict PostgREST exposure to authenticated internal services by requiring a valid JWT for all /rest/v1/* routes

bash

# Revoke anon access to the vulnerable view in Supabase/PostgreSQL
REVOKE SELECT ON public.global_stats FROM anon;
REVOKE SELECT ON public.global_stats FROM authenticated;

# Optional: enforce RLS and deny-by-default policy
ALTER VIEW public.global_stats SET (security_invoker = true);

# Reload PostgREST schema cache
NOTIFY pgrst, 'reload schema';