CVE-2026-56082: Capgo Authentication Bypass Enables Billing Record Tampering

Technical summary

CVE-2026-56082 is an improper access control vulnerability in Capgo versions before 12.128.2. The public.record_build_time PostgREST RPC function is marked as SECURITY DEFINER but is incorrectly granted to the anon role, making it callable via the public Supabase publishable key (sb_publishable_*). The function accepts an org_id parameter and uses ON CONFLICT (build_id, org_id) DO UPDATE to insert or upsert rows in public.build_logs. By reusing a known build_id, an unauthenticated attacker can overwrite existing billing records for arbitrary organizations, manipulating billable build time and creating financial denial of service.

Business impact

Organizations relying on Capgo for build tracking and billing could face disrupted financial reporting, inflated or corrupted billing records, and loss of trust in usage data integrity. Attackers could artificially increase billable time for competitors or customers, causing incorrect billing cycles, chargeback disputes, and operational confusion. If billing is tied to these logs, the attack directly affects revenue accuracy and customer trust. Multi-tenant deployments are particularly at risk since one compromised org can corrupt logs for many others.

Affected systems

Capgo versions prior to 12.128.2 are vulnerable. The vulnerability exists at the database layer in the PostgREST RPC interface and affects any Capgo deployment where the anon role is permitted to call the public.record_build_time function. Organizations using Capgo for build management and billing on affected versions should be considered at risk if the public API key is obtainable (which, by design, it is).

Exploitability

Exploitability is high. No authentication is required—an attacker only needs knowledge of the public Supabase publishable key (which is intentionally public) and valid build_id and org_id pairs. The attack requires only network access and can be executed via simple HTTP requests or database calls. There are no barriers to repeated exploitation. The CVSS score of 7.5 (High) reflects network-accessible, unauthenticated access with no user interaction and direct impact to integrity.

Remediation

Upgrade Capgo to version 12.128.2 or later. The patch should restrict the public.record_build_time function access so that only authenticated users (with appropriate role-based permissions) can call it, removing the grant to the anon role. Organizations must verify that the function is no longer callable via public API keys and test that legitimate build logging still functions correctly after patching.

Patch guidance

Apply version 12.128.2 or later of Capgo. Verify against the vendor's official release notes and advisory that the patch removes anon role access to the public.record_build_time function. Test in a staging environment to confirm that build recording continues to work for authenticated clients while rejecting unauthenticated requests. Monitor logs post-deployment for any failed build_time recording attempts that might indicate incomplete rollout or application misconfiguration.

Detection guidance

Search for unauthorized calls to the public.record_build_time function from unauthenticated sources (requests using only the public/anon key without a user session). Monitor for bulk inserts or updates to public.build_logs with mismatched or suspicious org_id values. Look for patterns of repeated build_id reuse across different organizations, especially with inflated build_time values. Review PostgREST access logs for high-frequency RPC calls from external IPs targeting this function. Correlate anomalies in build_logs with unusual billing spikes or usage discrepancies.

Why prioritize this

This vulnerability should be prioritized for immediate patching. It is unauthenticated, requires no user interaction, has direct integrity impact on billing records, and enables cross-tenant attacks. The financial and operational consequences are severe, particularly for SaaS platforms where billing accuracy is critical. Although not currently on the KEV catalog, the ease of exploitation and business impact warrant urgent remediation.

Risk score, explained

The CVSS 3.1 score of 7.5 (High) accurately reflects an unauthenticated network-accessible attack (AV:N, PR:N, UI:N) with high integrity impact (I:H) on billing and usage records, but no confidentiality or availability impact in the strict sense. The score does not fully capture the financial denial of service and cross-tenant trust violation, which elevate practical risk above the numeric score.

Frequently asked questions