CVE-2026-56214: Capgo Information Disclosure via Supabase RPC Endpoints

Technical summary

The vulnerability exists in Supabase PostgREST RPC endpoints is_trial_org and is_paying_org, which lack proper authentication controls. These functions accept organization identifiers and return distinguishable responses indicating billing status. Because they're callable via the public sb_publishable key (a credential embedded in client-side code), an unauthenticated attacker can systematically query the API to enumerate valid organizations and determine which ones maintain active paid subscriptions. The information disclosure stems from inadequate access control on sensitive business logic endpoints (CWE-200).

Business impact

This vulnerability creates two distinct operational risks. First, attackers gain a directory of all organizations using your platform, including company names and account types—enabling targeted phishing, account takeover campaigns, or competitive intelligence gathering. Second, the ability to identify paying customers arms threat actors with a customer segmentation tool to prioritize high-value targets for extortion, supply chain attacks, or social engineering. For SaaS platforms, this erodes customer trust and can trigger compliance violations if payment information inference is considered sensitive personal data under GDPR or similar regulations.

Affected systems

Capgo versions prior to 12.128.2 are affected. The vulnerability specifically targets deployments using Supabase as the backend, exploiting unauthenticated access to the is_trial_org and is_paying_org RPC endpoints. Any instance allowing client-side code to hold the public sb_publishable key while those endpoints lack role-based access controls is vulnerable.

Exploitability

Exploitability is straightforward and requires only network access. An attacker needs no authentication, no special privileges, and no user interaction. The attack is automatable: simple HTTP requests to known endpoint paths with sequential organization identifiers or names will reliably return status information. The public availability of the sb_publishable key in most web and mobile applications means the barrier to exploitation is negligible. No patched or updated software is required on the attacker's side, making this a persistent threat until Capgo is upgraded.

Remediation

Upgrade Capgo to version 12.128.2 or later. This patch version implements proper authentication and authorization controls on the affected RPC endpoints, ensuring that only authenticated users with appropriate permissions can query is_trial_org and is_paying_org. Additionally, review Supabase Row Level Security (RLS) policies to ensure sensitive business logic endpoints always validate caller identity before returning organization or billing data. Consider rotating or restricting the scope of public API keys if enumeration has already occurred.

Patch guidance

Update Capgo to 12.128.2 or later as soon as feasible. The patch should be treated as high-priority because the vulnerability is trivial to exploit and actively enables reconnaissance. Test the upgrade in a staging environment to verify that legitimate client calls to organization and billing endpoints still function correctly after RLS policies are enforced. If you maintain custom RPC functions for similar purposes, audit those functions immediately for comparable access control gaps.

Detection guidance

Monitor Supabase PostgREST logs for repeated or sequential calls to is_trial_org and is_paying_org endpoints from unauthenticated sessions or from the same IP address. Establish a baseline of normal query patterns; enumeration attacks will typically show high call volume with varying organization parameters in a short time window. Alert on any unauthenticated RPC invocations to these endpoints. Additionally, review API gateway access logs for POST requests to /.rpc/is_trial_org and /.rpc/is_paying_org that lack authentication tokens or show abnormal distribution of organization identifiers.

Why prioritize this

This vulnerability scores CVSS 7.5 (HIGH) due to high-confidence information disclosure with no complexity barriers, affecting confidentiality of sensitive business and customer data. While direct system compromise is not possible, the attack enables sophisticated secondary exploitation. The trivial exploitability and potential for large-scale automated enumeration warrant rapid patching ahead of less-actionable vulnerabilities. Organizations with large customer bases or high-value contracts should prioritize this within 24–48 hours.

Risk score, explained

The CVSS 7.5 score reflects a network-accessible vulnerability (AV:N) with low attack complexity (AC:L), no privilege requirements (PR:N), and no user interaction (UI:N). The scope is unchanged (S:U) because the impact is confined to confidentiality of data within the application's trust boundary. Confidentiality impact is rated HIGH due to the disclosure of organization existence and billing status—information that would normally require authentication to access. Integrity and availability are unaffected. The score appropriately captures the severity while acknowledging that remote unauthenticated exploitation is trivial.

Frequently asked questions