CVE-2026-56245: Supabase Capgo Auth Bypass Vulnerability

CVE-2026-56245 Overview

CVE-2026-56245 is an authorization bypass vulnerability in Supabase Capgo versions before 12.128.2. The flaw resides in the record_build_time Remote Procedure Call (RPC) function, which is declared with SECURITY DEFINER privileges. Unauthenticated attackers can call POST /rest/v1/rpc/record_build_time using a public API key to insert arbitrary build-time records. This enables cross-tenant billing manipulation, quota poisoning, and resource exhaustion against any organization on the platform. The vulnerability is tracked under [CWE-269: Improper Privilege Management].

Critical Impact
Unauthenticated attackers can poison billing and build-time accounting data for any tenant, leading to inflated charges, quota exhaustion, and integrity loss across multi-tenant deployments.

Affected Products

Supabase Capgo versions prior to 12.128.2
Deployments exposing the record_build_time RPC endpoint
Multi-tenant Capgo installations using the default Supabase REST API gateway

Discovery Timeline

2026-06-24 - CVE-2026-56245 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-56245

Vulnerability Analysis

The vulnerability exists in the record_build_time PostgreSQL function exposed through Supabase's PostgREST API. The function is declared with the SECURITY DEFINER attribute, meaning it executes with the privileges of the function owner rather than the caller. The function lacks proper authorization checks to verify that the caller has rights to record build-time entries for the specified organization identifier.

Attackers submit a POST request to /rest/v1/rpc/record_build_time using the public anon API key. The function accepts any organization identifier supplied in the request body and inserts a corresponding record into the build-time accounting table. This data feeds billing calculations and quota enforcement systems downstream.

Root Cause

The root cause is improper privilege management within the SECURITY DEFINER function. The function elevates the caller's effective privileges without performing tenant-scoped authorization checks. Specifically, it does not validate that auth.uid() or the JWT claims match the organization identifier supplied as a parameter. Row Level Security (RLS) policies are bypassed because SECURITY DEFINER functions run as the function owner.

Attack Vector

The attack vector is fully remote and unauthenticated. An attacker only needs the public anon API key, which is by design exposed to client applications. The attacker crafts an HTTP POST request targeting the RPC endpoint with a JSON body containing the victim organization identifier and an arbitrary build-time value. Repeated calls can inflate billing metrics, exhaust monthly build quotas, or corrupt usage analytics. See the GitHub Security Advisory and the VulnCheck Advisory for technical details.

Detection Methods for CVE-2026-56245

Indicators of Compromise

Unexpected POST requests to /rest/v1/rpc/record_build_time from unfamiliar source IP addresses
High-frequency RPC calls authenticated only with the anon API key rather than a user JWT
Sudden spikes in recorded build-time values inconsistent with actual CI/CD activity
Build-time records associated with organizations whose users were not active during the recorded window

Detection Strategies

Audit PostgreSQL logs for invocations of record_build_time and correlate against authenticated session context
Compare recorded build-time entries against actual build job logs from the application backend
Flag RPC calls where the JWT role equals anon but the function modifies tenant-scoped accounting data
Review API gateway logs for anomalous request patterns targeting /rest/v1/rpc/ endpoints

Monitoring Recommendations

Enable PostgreSQL audit logging for all SECURITY DEFINER function calls
Configure alerts when build-time totals exceed organization baselines by a defined threshold
Ingest Supabase API gateway logs into a centralized SIEM for cross-tenant correlation
Track per-organization build-time growth rate and alert on statistical anomalies

How to Mitigate CVE-2026-56245

Immediate Actions Required

Upgrade Supabase Capgo to version 12.128.2 or later without delay
Revoke and rotate the public anon API key if abuse is suspected
Audit the build_time accounting table for records inserted before the patch was applied
Reconcile billing and quota data against authoritative CI/CD build logs

Patch Information

The vendor released a fix in Capgo version 12.128.2. The patch adds authorization checks within the record_build_time function to validate that the caller has permission to record entries for the specified organization. Refer to the GitHub Security Advisory GHSA-42f8-v563-5763 for the official remediation guidance.

Workarounds

Revoke EXECUTE permission on record_build_time from the anon role until the patch is applied
Add a server-side RLS-like check inside the function comparing auth.jwt() claims to the organization parameter
Restrict the RPC endpoint at the API gateway layer to authenticated service roles only
Temporarily move build-time accounting to a backend-only service path until upgrade is complete

bash

# Configuration example: revoke anon access to the vulnerable RPC
REVOKE EXECUTE ON FUNCTION public.record_build_time FROM anon;
REVOKE EXECUTE ON FUNCTION public.record_build_time FROM authenticated;
GRANT EXECUTE ON FUNCTION public.record_build_time TO service_role;