CVE-2026-56311: Capgo Authorization Bypass Vulnerability

CVE-2026-56311 Overview

CVE-2026-56311 is an authorization bypass vulnerability in Capgo versions before 12.128.2. The flaw resides in the public.get_current_plan_max_org Remote Procedure Call (RPC) function exposed through Supabase. Unauthenticated attackers can invoke the endpoint with any organization Universally Unique Identifier (UUID) using only the public Supabase key. The function returns plan limit data for arbitrary tenants, including Monthly Active Users (MAU), bandwidth, storage, and build time quotas. The weakness is classified as [CWE-285] Improper Authorization.

Critical Impact
Unauthenticated cross-tenant disclosure of organization billing and plan limit data through a public RPC endpoint.

Affected Products

Capgo versions prior to 12.128.2
Self-hosted Capgo deployments exposing the Supabase RPC interface
Capgo backend public.get_current_plan_max_org function

Discovery Timeline

2026-06-22 - CVE-2026-56311 published to the National Vulnerability Database (NVD)
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-56311

Vulnerability Analysis

The vulnerability stems from missing authorization checks in the public.get_current_plan_max_org RPC function. Capgo exposes this function through the Supabase Application Programming Interface (API), which accepts requests authenticated with the project's public anon key. The function accepts an organization UUID as a parameter and returns the plan limits associated with that organization. It does not verify whether the caller is a member of the requested organization or holds any role within it. An attacker who knows or guesses a target organization UUID can therefore retrieve billing-related metadata for that tenant.

Root Cause

The root cause is improper authorization within the RPC implementation. The function logic trusts the supplied organization identifier and queries the underlying plan tables without enforcing Row Level Security (RLS) policies or membership validation. Supabase's anon key, intended only for public read access to non-sensitive resources, is sufficient to execute the call. The result is a direct violation of tenant isolation in a multi-tenant Software-as-a-Service (SaaS) backend.

Attack Vector

Exploitation requires no authentication, no user interaction, and only network access to the Capgo Supabase endpoint. An attacker collects organization UUIDs from public Capgo deployments, distributed JavaScript bundles, or enumeration sources. The attacker then issues a POST request to the /rest/v1/rpc/get_current_plan_max_org path, including the public Supabase anon key in the apikey header and the target organization UUID in the JSON body. The server responds with the plan limits, disclosing MAU, bandwidth, storage, and build time allocations for that organization. The technical mechanism is described in the GitHub Security Advisory GHSA-v3jp-r95g-x4mm and the VulnCheck Advisory on Capgo.

Detection Methods for CVE-2026-56311

Indicators of Compromise

HTTP POST requests to /rest/v1/rpc/get_current_plan_max_org from external Internet Protocol (IP) addresses without an associated authenticated user session.
Repeated RPC calls iterating across multiple organization UUIDs from a single source within a short time window.
Requests carrying only the public anon apikey header and no Authorization: Bearer JSON Web Token (JWT).

Detection Strategies

Review Supabase PostgREST and database logs for invocations of get_current_plan_max_org and correlate the supplied UUID against organization membership tables.
Alert on bulk enumeration patterns where one client requests plan limits for more than a small number of distinct organization UUIDs.
Flag anonymous RPC traffic to functions that return tenant-scoped data, particularly those returning quota or billing fields.

Monitoring Recommendations

Enable PostgreSQL statement logging for SECURITY DEFINER functions and ship logs to a centralized analytics platform for retention and review.
Baseline normal call volume to plan and billing RPC endpoints, then alert on deviations and anonymous spikes.
Track outbound responses from the Supabase API for size and field signatures matching plan limit payloads (mau, bandwidth, storage, build_time).

How to Mitigate CVE-2026-56311

Immediate Actions Required

Upgrade Capgo to version 12.128.2 or later, which restores authorization checks in the affected RPC function.
Rotate the Supabase anon key if abuse is suspected and audit RPC access logs for unauthorized enumeration.
Inventory other Capgo RPC functions and confirm each enforces caller-to-organization membership validation.

Patch Information

The maintainers fixed the issue in Capgo 12.128.2 by adding caller authorization within public.get_current_plan_max_org. The patched function now validates that the requesting identity is a member of the supplied organization before returning plan limit data. Patch details are documented in the GitHub Security Advisory GHSA-v3jp-r95g-x4mm.

Workarounds

Revoke EXECUTE permission on public.get_current_plan_max_org from the anon role until patching is complete.
Add a Row Level Security policy or explicit membership check inside the function to reject calls from non-members of the target organization.
Place the Supabase endpoint behind a Web Application Firewall (WAF) rule that blocks anonymous calls to plan and billing RPC paths.

bash

# Revoke anonymous execution on the vulnerable RPC until patched
REVOKE EXECUTE ON FUNCTION public.get_current_plan_max_org(uuid) FROM anon;
REVOKE EXECUTE ON FUNCTION public.get_current_plan_max_org(uuid) FROM PUBLIC;