CVE-2026-56303: Capgo Information Disclosure Vulnerability

CVE-2026-56303 Overview

CVE-2026-56303 is an information disclosure vulnerability affecting Capgo versions before 12.128.2. The flaw resides in the find_apikey_by_value PostgreSQL function, which is declared SECURITY DEFINER and granted execute permissions to the anon role. Unauthenticated attackers can invoke this function through the /rest/v1/rpc/find_apikey_by_value REST endpoint. Supplying a valid API key value returns sensitive metadata, including user_id, mode, organization scoping, and expiration details. The issue is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Remote, unauthenticated attackers can enumerate Capgo API key metadata over HTTPS with no user interaction, exposing account and organization context tied to any known key value.

Affected Products

Capgo versions prior to 12.128.2
Deployments exposing the PostgREST /rest/v1/rpc/find_apikey_by_value endpoint
Instances where the anon role retains execute privileges on the affected function

Discovery Timeline

2026-07-11 - CVE-2026-56303 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-56303

Vulnerability Analysis

Capgo exposes PostgreSQL functions to clients through PostgREST-style RPC endpoints. The find_apikey_by_value function was configured with the SECURITY DEFINER attribute, causing it to execute with the privileges of its owner rather than the caller. Combined with an execute grant to the anon role, the function became reachable by unauthenticated HTTP clients.

When an attacker supplies a valid key value, the function returns the associated metadata directly in the JSON response. This bypasses the Row Level Security policies that would otherwise restrict access to the apikeys table. The disclosure enables account correlation, organization mapping, and identification of key modes and expiration windows useful for follow-on attacks.

Root Cause

The root cause is a privilege misconfiguration on a database function. Assigning SECURITY DEFINER to a lookup routine and granting EXECUTE to anon effectively creates an authorization bypass around the underlying table's access controls. See the GitHub Security Advisory GHSA-2xjq-h43m-592f for the maintainer analysis.

Attack Vector

An unauthenticated attacker sends an HTTPS POST request to /rest/v1/rpc/find_apikey_by_value with a JSON body containing a candidate key value. If the value matches an existing record, the endpoint returns the associated user_id, mode, organization scoping fields, and expiration timestamps. No authentication header, session, or user interaction is required. Additional detail is available in the VulnCheck Advisory on Capgo.

// No verified exploit code is published. The vulnerability is triggered by
// invoking the SECURITY DEFINER RPC function with a candidate key value
// against the /rest/v1/rpc/find_apikey_by_value endpoint.

Detection Methods for CVE-2026-56303

Indicators of Compromise

HTTP requests to /rest/v1/rpc/find_apikey_by_value originating from unauthenticated clients or unexpected source IPs
Repeated POST requests to the RPC endpoint indicating brute-force or enumeration attempts
Successful 200 responses to the endpoint containing user_id, mode, or expiration fields from anonymous sessions

Detection Strategies

Review PostgREST and reverse proxy access logs for calls to the find_apikey_by_value RPC path.
Audit PostgreSQL function definitions for any routine marked SECURITY DEFINER with an execute grant to anon or public.
Correlate high-volume anonymous RPC traffic against baseline API usage to detect enumeration behavior.

Monitoring Recommendations

Enable PostgreSQL log_statement = 'all' on non-production tiers and alert on invocations of sensitive functions.
Instrument web application firewall rules to flag anonymous POSTs to any /rest/v1/rpc/* endpoint tied to credential lookups.
Track the EPSS trajectory for CVE-2026-56303 and alert on changes that suggest emerging exploitation activity.

How to Mitigate CVE-2026-56303

Immediate Actions Required

Upgrade Capgo to version 12.128.2 or later without delay.
Revoke EXECUTE on find_apikey_by_value from the anon role and any other unauthenticated identity.
Rotate API keys that may have been enumerated while the endpoint was exposed.
Review database audit logs for prior invocations of the vulnerable function.

Patch Information

Capgo maintainers addressed the issue in release 12.128.2. The fix removes anonymous execute access to the affected RPC and re-scopes the function so key metadata is no longer reachable without proper authorization. Consult the GitHub Security Advisory GHSA-2xjq-h43m-592f for the authoritative patch reference.

Workarounds

Drop the find_apikey_by_value function or restrict it to trusted server-side roles if patching is not immediately possible.
Block or rate-limit the /rest/v1/rpc/find_apikey_by_value path at the reverse proxy or WAF layer until the upgrade is applied.
Enforce network-level restrictions on the PostgREST interface so it is not directly reachable by untrusted networks.

bash

# Revoke anonymous access to the vulnerable function
REVOKE EXECUTE ON FUNCTION public.find_apikey_by_value(text) FROM anon;
REVOKE EXECUTE ON FUNCTION public.find_apikey_by_value(text) FROM PUBLIC;