CVE-2026-56284
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
An information disclosure vulnerability in Capgo before version 12.128.2 exists in the Supabase PostgREST RPC function public.get_total_metrics(org_id), which is callable by the anon role using only the public sb_publishable_* key. An unauthenticated attacker can probe organization existence and leak sensitive usage metrics including MAU, bandwidth, and install counts by sending POST requests to /rest/v1/rpc/get_total_metrics with valid organization UUIDs.
Risk Assessment
The risk involves unauthorized access to sensitive organizational data, potentially leading to privacy breaches, leakage of client information, and possible exploitation of this data for further attacks.
Recommendation
Immediately upgrade Capgo to version 12.128.2 or later and restrict access to the RPC function to authenticated users with appropriate permissions only.
Original NVD description (English source)
Capgo (Cap-go/capgo) before 12.128.2 contains an information disclosure vulnerability in the Supabase PostgREST RPC function public.get_total_metrics(org_id), which is callable by the anon role using only the public sb_publishable_* key. An unauthenticated attacker can probe organization existence and leak sensitive usage metrics including MAU, bandwidth, and install counts by sending POST requests to /rest/v1/rpc/get_total_metrics with valid organization UUIDs.