CVE-2026-56213
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk14th percentile — higher than 14% of all known CVEs
Summary
Capgo before 12.128.2 contains an authorization bypass vulnerability in the public.upsert_version_meta SECURITY DEFINER function exposed via PostgREST RPC. This allows unauthenticated attackers to insert arbitrary rows into version_meta for any app_id.
Risk Assessment
Attackers can exploit this vulnerability to poison storage metrics, causing persistent false data in dashboards and triggering incorrect alerts across victim applications.
Recommendation
It is recommended to update Capgo to version 12.128.2 or later to mitigate this vulnerability. Additionally, access to the RPC function should be restricted to authorized users only.
Original NVD description (English source)
Capgo before 12.128.2 contains an authorization bypass vulnerability in the public.upsert_version_meta SECURITY DEFINER function exposed via PostgREST RPC, allowing unauthenticated attackers to insert arbitrary rows into version_meta for any app_id. Attackers can exploit this by calling the RPC endpoint with a public anon key to poison storage metrics, causing persistent false data in dashboards and triggering incorrect alerts across victim applications.