CVE-2026-56321: Capgo Authentication Bypass Vulnerability

CVE-2026-56321 Overview

CVE-2026-56321 affects Capgo, an open-source platform delivered through Supabase edge functions. Versions before 12.128.2 fail to apply the global authentication middleware to the GET /private/role_bindings/:org_id endpoint. The POST and DELETE routes on the same path enforce the middleware correctly, creating inconsistent authentication enforcement across HTTP methods. Unauthenticated requests reach the handler instead of being rejected at the middleware layer. The handler still performs its own authorization check and returns Unauthorized, so no direct data exposure occurs. The flaw is classified under [CWE-306] (Missing Authentication for Critical Function).

Critical Impact
Inconsistent middleware enforcement could enable authorization bypass if handler-level checks regress in future code changes.

Affected Products

Capgo backend (Supabase edge functions) prior to version 12.128.2
GET /private/role_bindings/:org_id endpoint specifically
Deployments running affected Capgo self-hosted or managed backend

Discovery Timeline

2026-06-22 - CVE-2026-56321 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-56321

Vulnerability Analysis

The vulnerability stems from a routing configuration gap in the Capgo backend. Capgo registers global authentication middleware that rejects unauthenticated requests before they reach route handlers. The POST and DELETE handlers for /private/role_bindings/:org_id are properly wired into this middleware chain. The GET handler on the same path is not, allowing unauthenticated HTTP requests to pass through to the handler function. The handler itself contains a defense-in-depth authorization check that rejects unauthorized callers with a 401 Unauthorized response. This second layer prevents direct data disclosure under current code. The risk surfaces if a maintainer modifies the handler and assumes the middleware already filtered unauthenticated callers.

Root Cause

The route registration logic omits the authentication middleware wrapper for the GET method on the role bindings endpoint. The POST and DELETE methods on the same path correctly invoke the middleware. This represents an inconsistent application of authentication controls across HTTP verbs sharing a single route path.

Attack Vector

The endpoint is network-reachable and requires no privileges or user interaction. An attacker can send unauthenticated GET requests to /private/role_bindings/:org_id and reach the handler. Under the current code, the handler returns Unauthorized. No code example is published for this defense-in-depth issue. Refer to the GitHub Security Advisory and the VulnCheck Advisory on Authentication for additional context.

Detection Methods for CVE-2026-56321

Indicators of Compromise

Unauthenticated HTTP GET requests to /private/role_bindings/:org_id reaching application logs rather than middleware rejection logs.
Repeated 401 responses from the role_bindings handler that suggest probing of the inconsistent route.
Edge function invocations on the GET role_bindings path without an associated authenticated session identifier.

Detection Strategies

Audit Supabase edge function logs to compare middleware rejection counts across POST, DELETE, and GET methods on /private/role_bindings/:org_id.
Review route registration code to confirm authentication middleware is applied uniformly to every method on private endpoints.
Add runtime assertions or tests that send unauthenticated requests to every private route and verify rejection at the middleware layer.

Monitoring Recommendations

Alert on any handler-level Unauthorized responses originating from routes that should be filtered earlier by middleware.
Track the Capgo backend version deployed and flag any instance running a release earlier than 12.128.2.
Monitor changes to route registration files in code review to ensure middleware coverage is preserved.

How to Mitigate CVE-2026-56321

Immediate Actions Required

Upgrade the Capgo backend to version 12.128.2 or later, where the GET role_bindings route is wired into the global authentication middleware.
Inventory all deployed Capgo edge function environments and confirm the patched version is running.
Review custom route definitions for similar inconsistent middleware application across HTTP verbs.

Patch Information

The fix is included in Capgo 12.128.2. The patched release applies the global authentication middleware to the GET /private/role_bindings/:org_id endpoint, aligning enforcement with the POST and DELETE handlers. Patch details are published in the GitHub Security Advisory.

Workarounds

Place an external authentication gateway or reverse proxy in front of the Capgo backend to reject unauthenticated requests to /private/* paths.
Add an explicit authentication wrapper to the GET handler in local forks until the upstream patch is deployed.
Restrict network access to the role_bindings endpoint to trusted clients using firewall rules or Supabase function access policies.

bash

# Configuration example
# Verify Capgo backend version meets the patched release
npm list @capgo/capgo | grep capgo
# Expected: capgo@12.128.2 or later