CVE-2026-56284: Capgo Information Disclosure Vulnerability

CVE-2026-56284 Overview

CVE-2026-56284 is an information disclosure vulnerability in Capgo (Cap-go/capgo) versions prior to 12.128.2. The flaw resides in the Supabase PostgREST remote procedure call (RPC) function public.get_total_metrics(org_id), which is exposed to the anon role. An unauthenticated attacker who possesses only the public sb_publishable_* key can invoke the RPC endpoint and enumerate organization existence by supplying candidate UUIDs. Successful calls return sensitive usage metrics including monthly active users (MAU), bandwidth consumption, and install counts. The weakness is classified as [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Unauthenticated remote attackers can enumerate Capgo organizations and harvest business-sensitive usage metrics through a single HTTP POST request.

Affected Products

Capgo (Cap-go/capgo) versions prior to 12.128.2
Deployments exposing the Supabase PostgREST get_total_metrics RPC to the anon role
Instances using publicly distributable sb_publishable_* keys without additional authorization checks

Discovery Timeline

2026-07-08 - CVE-2026-56284 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-56284

Vulnerability Analysis

Capgo exposes a PostgREST RPC endpoint at /rest/v1/rpc/get_total_metrics that accepts an org_id parameter of UUID type. The function was granted execute permission to the anon role, allowing any client presenting the publishable API key to invoke it. Because the publishable key is intended for client-side use and is not a secret, this effectively renders the endpoint unauthenticated. When called with a valid organization UUID, the function returns aggregate metrics (MAU, bandwidth, install counts) that reveal both organizational existence and quantitative business data. Invalid UUIDs return distinguishable responses, enabling reliable enumeration.

Root Cause

The root cause is missing authorization on the public.get_total_metrics PostgreSQL function combined with an overly broad grant to the anon role. Row-level security and function-level access controls in Supabase must be explicitly configured; the affected version relied on obscurity of organization UUIDs rather than enforced authorization. The publishable key model does not provide identity assurance, so functions that expose tenant-scoped data must validate the caller's session or restrict execution to authenticated roles.

Attack Vector

An attacker sends a POST request to /rest/v1/rpc/get_total_metrics with the apikey and Authorization headers set to a valid sb_publishable_* key and a JSON body containing an org_id UUID. Valid UUIDs yield the metrics payload, while unknown UUIDs return a distinct empty result. Attackers who obtain organization identifiers from public sources, mobile application bundles, or update manifests can convert them into detailed usage intelligence without triggering authentication logs.

No verified proof-of-concept code has been published beyond the advisory description. See the GitHub Security Advisory and the VulnCheck Advisory for technical details.

Detection Methods for CVE-2026-56284

Indicators of Compromise

POST requests to /rest/v1/rpc/get_total_metrics originating from unexpected client IP addresses or user agents
High-volume enumeration patterns cycling through UUID values against the same RPC endpoint
Requests presenting only the sb_publishable_* key without an accompanying user JWT in the Authorization header

Detection Strategies

Query PostgREST or reverse-proxy access logs for calls to rpc/get_total_metrics and baseline expected caller identities
Alert on requests to tenant-scoped RPC endpoints where the JWT role claim is anon
Correlate spikes in get_total_metrics invocations with distinct org_id values indicative of enumeration

Monitoring Recommendations

Enable Supabase database and PostgREST request logging and forward events to a centralized analytics platform
Track per-IP request rates to /rest/v1/rpc/* endpoints and threshold on unusual bursts
Review PostgreSQL pg_stat_user_functions counters for anomalous execution counts on get_total_metrics

How to Mitigate CVE-2026-56284

Immediate Actions Required

Upgrade Capgo to version 12.128.2 or later, which restricts execution of get_total_metrics to authenticated principals
Rotate any sb_publishable_* keys that may have been used in enumeration attempts and audit their scope
Review all PostgREST-exposed functions and revoke EXECUTE from the anon role where not strictly required

Patch Information

The maintainer released a fix in Capgo 12.128.2. The patch removes the ability of the anon role to invoke public.get_total_metrics and enforces authorization based on the caller's session and organization membership. Refer to the GitHub Security Advisory GHSA-h5jf-xgvh-hgjw for the authoritative fix details.

Workarounds

Revoke EXECUTE on public.get_total_metrics(uuid) from the anon role at the database level until the upgrade can be applied
Add a PostgREST pre-request hook or reverse-proxy rule that blocks unauthenticated calls to /rest/v1/rpc/get_total_metrics
Enforce row-level security policies that require auth.uid() to belong to the requested organization before returning metrics

bash

# Configuration example - revoke anon access to the vulnerable RPC
psql "$SUPABASE_DB_URL" <<'SQL'
REVOKE EXECUTE ON FUNCTION public.get_total_metrics(uuid) FROM anon;
REVOKE EXECUTE ON FUNCTION public.get_total_metrics(uuid) FROM PUBLIC;
GRANT  EXECUTE ON FUNCTION public.get_total_metrics(uuid) TO authenticated;
SQL