CVE-2026-56239 Overview
CVE-2026-56239 is a privilege escalation vulnerability in Capgo before version 12.128.2. The flaw resides in the public.apply_usage_overage PostgreSQL function, which is declared as SECURITY DEFINER and performs sensitive billing operations. The function lacks internal authorization checks, including validation of auth.uid(), organization membership, and check_min_rights. Because it executes with the owner's privileges, it bypasses Row Level Security (RLS). An authenticated user can invoke the function through Supabase Remote Procedure Call (RPC) to manipulate billing data for arbitrary organizations. The vulnerability is categorized under [CWE-269] Improper Privilege Management.
Critical Impact
Authenticated attackers can deplete credits and insert fraudulent overage events for any organization, bypassing tenant isolation in Capgo's billing layer.
Affected Products
- Capgo versions before 12.128.2
- Deployments exposing apply_usage_overage via Supabase RPC
- Instances where EXECUTE is granted to authenticated or anon roles
Discovery Timeline
- 2026-06-21 - CVE-2026-56239 published to the National Vulnerability Database (NVD)
- 2026-06-24 - Last updated in NVD database
Technical Details for CVE-2026-56239
Vulnerability Analysis
The vulnerability stems from improper privilege management in a PostgreSQL function exposed through Supabase. Capgo defines public.apply_usage_overage with the SECURITY DEFINER attribute, meaning the function runs with the privileges of the function owner rather than the calling user. Row Level Security policies that normally constrain access to billing tables are therefore bypassed during execution.
The function performs sensitive billing actions, including credit deduction and overage event insertion. However, it omits the standard authorization controls used elsewhere in the Capgo codebase. There is no check on auth.uid() to identify the caller, no verification that the caller belongs to the target organization, and no invocation of check_min_rights to enforce role-based access. The result is that any caller able to execute the function can affect any organization's billing records.
Root Cause
The root cause is a missing authorization layer inside a SECURITY DEFINER function. SECURITY DEFINER functions intentionally elevate privileges to perform owner-only operations, which makes internal authorization checks mandatory. In apply_usage_overage, organization identifiers are accepted as parameters and used directly in billing mutations without validating that the authenticated caller has rights over the supplied organization.
Attack Vector
Exploitation requires only an authenticated Supabase session, or anonymous access if EXECUTE is granted to the anon role through explicit grants or default privileges. An attacker calls the function over Supabase RPC and supplies an arbitrary org_id and overage parameters. The function then mutates billing data on behalf of that organization. Successful exploitation enables unauthorized credit depletion against victim tenants and insertion of fraudulent overage events that can distort billing records and downstream invoicing.
The exploitation mechanism is described in the GitHub Security Advisory GHSA-qq85-vjrq-m75g and the VulnCheck Privilege Escalation Advisory.
Detection Methods for CVE-2026-56239
Indicators of Compromise
- Unexpected RPC calls to apply_usage_overage from authenticated or anon roles in PostgreSQL logs.
- Sudden credit balance reductions or overage rows inserted for organizations with no corresponding application activity.
- Repeated invocations of the function with varying org_id parameters from a single session.
Detection Strategies
- Enable PostgreSQL function call auditing and alert on executions of apply_usage_overage outside trusted server contexts.
- Reconcile overage events against application telemetry to flag rows lacking matching usage signals.
- Inspect information_schema.role_table_grants and function ACLs to identify roles holding EXECUTE on apply_usage_overage.
Monitoring Recommendations
- Stream Supabase and PostgreSQL audit logs to a central SIEM and build identifications around SECURITY DEFINER function invocations.
- Track anomalous spikes in billing-table writes per tenant and alert on cross-tenant mutations from a single authenticated user.
- Monitor for grants of EXECUTE to anon or authenticated on billing-related functions through schema change detection.
How to Mitigate CVE-2026-56239
Immediate Actions Required
- Upgrade Capgo to version 12.128.2 or later, which contains the authorization fix.
- Revoke EXECUTE on public.apply_usage_overage from the anon and authenticated roles until the upgrade is complete.
- Review default privileges in the public schema to ensure new functions are not automatically exposed to client roles.
- Audit billing tables for unauthorized credit depletion or fraudulent overage rows created before the patch was applied.
Patch Information
The maintainers released a fix in Capgo 12.128.2. The patched function enforces caller identity through auth.uid(), validates organization membership, and applies check_min_rights before performing billing mutations. Refer to the GitHub Security Advisory GHSA-qq85-vjrq-m75g for the upstream commit references and remediation guidance.
Workarounds
- Revoke direct EXECUTE permissions on apply_usage_overage from client-facing roles and call the function only from trusted server-side contexts.
- Wrap billing operations behind a server-side API that performs explicit authorization before invoking PostgreSQL functions.
- Convert the function from SECURITY DEFINER to SECURITY INVOKER where feasible so RLS policies apply to the caller.
# Configuration example: revoke execute privileges until patched
psql -c "REVOKE EXECUTE ON FUNCTION public.apply_usage_overage FROM anon, authenticated;"
psql -c "ALTER DEFAULT PRIVILEGES IN SCHEMA public REVOKE EXECUTE ON FUNCTIONS FROM anon, authenticated;"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
