CVE-2026-56337: Capgo Information Disclosure Vulnerability

CVE-2026-56337 Overview

CVE-2026-56337 is an information disclosure vulnerability in Capgo versions prior to 12.128.2. The flaw resides in the public.exist_app_v2 Remote Procedure Call (RPC) function, which is declared as SECURITY DEFINER and exposed without authentication. Unauthenticated attackers can issue POST /rest/v1/rpc/exist_app_v2 requests with arbitrary appid parameters to determine whether a given app identifier exists in the public.apps table. The weakness, classified under [CWE-200], enables cross-tenant app enumeration and privacy violations in multi-tenant Capgo deployments.

Critical Impact
Remote unauthenticated attackers can enumerate tenant-owned app IDs across the Capgo platform, exposing private application metadata and enabling reconnaissance for follow-on attacks.

Affected Products

Capgo versions before 12.128.2
Capgo self-hosted deployments exposing the public.exist_app_v2 RPC endpoint
Multi-tenant Capgo installations relying on Supabase PostgREST RPC routing

Discovery Timeline

2026-06-24 - CVE-2026-56337 published to the National Vulnerability Database (NVD)
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-56337

Vulnerability Analysis

Capgo exposes a PostgREST-style RPC interface at /rest/v1/rpc/exist_app_v2. The underlying database function public.exist_app_v2 is created with the SECURITY DEFINER attribute, meaning it executes with the privileges of the function owner rather than the calling role. Because the endpoint accepts requests from the anonymous role and performs no caller identity check, any remote client can supply an appid value and receive a boolean indicating whether that app exists in public.apps.

This enables boolean-oracle enumeration of tenant data. By iterating over candidate appid values, an attacker recovers a list of valid identifiers belonging to other tenants. The information disclosure is limited to existence confirmation, which aligns with the limited confidentiality impact in the CVSS vector, but it undermines the multi-tenant isolation model.

Root Cause

The root cause is a missing authorization check inside a privileged database function. SECURITY DEFINER functions must validate that the caller is permitted to act on the rows they query. The exist_app_v2 function instead trusts the input appid and performs an existence lookup against public.apps without filtering by the calling user's tenant or session, violating the principle of least privilege [CWE-200].

Attack Vector

Attacks are launched over the network with no authentication, no privileges, and no user interaction. An attacker sends repeated HTTP POST requests to /rest/v1/rpc/exist_app_v2 with JSON bodies of the form {"appid": "<candidate>"}. The JSON response reveals whether the supplied app ID exists, allowing brute-force or dictionary-based enumeration across the entire tenant population. No exploit code is currently published, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

For full technical context, see the GitHub Security Advisory GHSA-wjqr-gmx8-jj56 and the VulnCheck Advisory.

Detection Methods for CVE-2026-56337

Indicators of Compromise

High-volume POST requests to /rest/v1/rpc/exist_app_v2 originating from a single IP address or autonomous system.
Sequential or dictionary-style appid values in request bodies, especially from anonymous Supabase JWT roles.
Elevated rates of small JSON responses (boolean payloads) returned by the PostgREST gateway for the exist_app_v2 route.

Detection Strategies

Parse PostgREST and reverse-proxy access logs for the /rest/v1/rpc/exist_app_v2 path and alert on request rates exceeding a normal user baseline.
Correlate requests by source IP, apikey header, and JWT role claim to surface anonymous callers invoking the RPC at scale.
Compare unique appid values per source over rolling windows to detect enumeration behavior rather than legitimate single lookups.

Monitoring Recommendations

Ship PostgREST, NGINX, and PostgreSQL audit logs to a centralized analytics platform and retain them for at least 90 days.
Add a Web Application Firewall (WAF) rule that rate-limits the exist_app_v2 route per source IP and per API key.
Enable PostgreSQL log_statement = 'mod' or pgaudit for calls to public.exist_app_v2 to capture parameter values for forensic review.

How to Mitigate CVE-2026-56337

Immediate Actions Required

Upgrade Capgo to version 12.128.2 or later on all self-hosted instances.
Revoke EXECUTE privileges on public.exist_app_v2 from the anon and authenticated roles until the patched version is deployed.
Audit PostgREST logs for prior enumeration of the exist_app_v2 endpoint and notify affected tenants if anomalous activity is found.

Patch Information

The maintainers fixed the issue in Capgo 12.128.2. The patch removes unauthenticated access to public.exist_app_v2 and enforces tenant-scoped authorization within the function. Refer to the GitHub Security Advisory GHSA-wjqr-gmx8-jj56 for upgrade instructions and commit references.

Workarounds

Restrict network access to the PostgREST /rest/v1/rpc/exist_app_v2 route at the reverse-proxy or API gateway layer until patching is complete.
Apply a database-level REVOKE EXECUTE ON FUNCTION public.exist_app_v2(text) FROM anon, authenticated; statement to block anonymous invocation.
Deploy WAF rate-limiting on the RPC path to slow enumeration attempts where immediate upgrades are not feasible.

bash

# Configuration example: revoke anonymous access to the vulnerable RPC
psql "$DATABASE_URL" <<'SQL'
REVOKE EXECUTE ON FUNCTION public.exist_app_v2(text) FROM anon;
REVOKE EXECUTE ON FUNCTION public.exist_app_v2(text) FROM authenticated;
SQL