CVE-2026-56244: Capgo Information Disclosure Vulnerability

CVE-2026-56244 Overview

CVE-2026-56244 affects Capgo versions before 12.128.2. The vulnerability allows non-admin API keys to read webhook signing secrets through the Supabase REST interface. Insufficient row-level security (RLS) policies on the webhooks table expose sensitive signing material to lower-privileged callers. Attackers who obtain a non-admin API key can retrieve webhook secrets and forge valid X-Capgo-Signature headers. This breaks webhook authenticity and integrity, enabling attackers to send authenticated webhook events to configured receivers. The flaw is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Attackers holding any non-admin API key can disclose webhook signing secrets and impersonate the Capgo platform to downstream receivers, undermining webhook trust boundaries.

Affected Products

Capgo versions prior to 12.128.2
Self-hosted Capgo deployments using Supabase as the backend
Integrations relying on X-Capgo-Signature header verification

Discovery Timeline

2026-06-24 - CVE-2026-56244 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-56244

Vulnerability Analysis

The vulnerability stems from misconfigured row-level security policies on the webhooks table in Capgo's Supabase backend. Capgo uses Supabase REST (PostgREST) to expose database tables to authenticated clients. Access control on individual rows and columns depends entirely on PostgreSQL RLS policies. The webhooks table contains the per-tenant signing secret used to compute the X-Capgo-Signature header on outbound webhook events. The RLS policy on this table did not restrict read access to admin roles. Any caller presenting a valid non-admin API key could query the table and retrieve the plaintext signing secret.

Once an attacker holds the secret, they can compute valid HMAC signatures over arbitrary payloads. Downstream receivers that trust the X-Capgo-Signature header will accept forged events as authentic Capgo notifications. This collapses the integrity guarantee that webhook signing is designed to provide.

Root Cause

The root cause is an authorization gap in the Supabase RLS configuration. The webhook secret column lacked a policy restricting SELECT to administrative roles. Sensitive cryptographic material was treated like ordinary tenant data and exposed through the standard REST surface.

Attack Vector

An attacker requires a valid non-admin API key for the target Capgo tenant. The attacker issues a REST query against the webhooks endpoint via Supabase and reads the returned signing secret. They then craft arbitrary webhook payloads, compute the HMAC signature using the disclosed secret, and submit signed requests directly to the victim's configured webhook receivers. Refer to the GitHub Security Advisory GHSA-qrrx-x3qf-x87v and the VulnCheck Security Advisory for technical details.

Detection Methods for CVE-2026-56244

Indicators of Compromise

Unexpected SELECT queries against the webhooks table from non-admin API keys in Supabase audit logs.
Webhook events received by downstream systems that do not correspond to actions recorded in Capgo's application logs.
Anomalous source IP addresses delivering signed webhook payloads to receiver endpoints.

Detection Strategies

Enable PostgreSQL query logging on the webhooks table and alert on any read by a non-admin role.
Correlate outbound webhook delivery logs in Capgo with inbound webhook receipts at downstream services to surface receiver-side events without matching senders.
Hunt for API key identifiers that performed reads on sensitive tables shortly before unusual webhook traffic spikes.

Monitoring Recommendations

Ingest Supabase and PostgREST request logs into a centralized analytics platform for retroactive search.
Track API key usage patterns and flag non-admin keys accessing tables outside their normal scope.
Monitor webhook receiver logs for signature verification successes paired with payload anomalies such as duplicate event IDs or unexpected event types.

How to Mitigate CVE-2026-56244

Immediate Actions Required

Upgrade Capgo to version 12.128.2 or later immediately.
Rotate all webhook signing secrets after upgrading, since prior secrets may be considered disclosed.
Revoke and reissue non-admin API keys that may have queried the webhooks table before the patch.
Audit downstream receivers for unexpected webhook events delivered prior to remediation.

Patch Information

The fix is included in Capgo 12.128.2. The patch tightens row-level security policies on the webhooks table so that webhook signing secrets are no longer readable by non-admin API keys. Operators of self-hosted Capgo deployments must apply the upgrade and ensure the corresponding Supabase migrations have executed.

Workarounds

Restrict access to the webhooks table by manually applying RLS policies that limit SELECT on the secret column to admin roles only.
Disable webhook signing temporarily and require mutual TLS or IP allowlisting between Capgo and receivers until patched.
Limit issuance of non-admin API keys and minimize their scope until the upgrade is completed.

bash

# Example PostgreSQL RLS policy hardening (apply only if you understand your schema)
ALTER TABLE public.webhooks ENABLE ROW LEVEL SECURITY;

CREATE POLICY webhooks_admin_read_only
  ON public.webhooks
  FOR SELECT
  USING (auth.role() = 'admin');

REVOKE SELECT ON public.webhooks FROM anon, authenticated;
GRANT SELECT ON public.webhooks TO service_role;