CVE-2026-56239: Capgo Billing Privilege Escalation via Unprotected SECURITY DEFINER Function

Technical summary

The vulnerability exists in the public.apply_usage_overage function, which is marked as a SECURITY DEFINER routine. SECURITY DEFINER functions in PostgreSQL execute with the privileges of the function owner, effectively bypassing Row Level Security policies that would normally protect data. The function performs sensitive billing operations—including credit depletion and overage event insertion—without validating auth.uid(), organization membership, or invoking check_min_rights authorization logic. If EXECUTE permission is granted to authenticated or anonymous roles (either explicitly or via default privilege inheritance), any authenticated user can invoke the function via Supabase's Remote Procedure Call interface to manipulate billing data across arbitrary organizations.

Business impact

This vulnerability enables unauthorized financial manipulation within Capgo's billing system. Attackers with legitimate authentication credentials could deplete credits from competing or arbitrary customer organizations, insert false overage charges to inflate billing, or redirect revenue attribution. For Capgo customers, the risk manifests as unauthorized deductions, incorrect invoices, and potential service disruptions if credits are fraudulently consumed. For Capgo itself, the exposure includes revenue leakage, customer trust erosion, disputed charges, and potential regulatory liability if billing integrity cannot be guaranteed.

Affected systems

Capgo versions before 12.128.2 are affected. The vulnerability is specific to the Supabase PostgreSQL backend implementation and requires network access to Capgo's RPC endpoints. Any authenticated user with access to Capgo's API or UI can trigger the vulnerable function.

Exploitability

Exploitability is moderate to high. The attack requires valid authentication credentials (satisfying the PR:L requirement in the CVSS vector), but no social engineering or special user interaction is needed once authenticated. The RPC interface is designed for programmatic access, making remote exploitation straightforward. No client-side exploit code is required—the vulnerability is invoked through standard API calls. The primary barrier is obtaining legitimate credentials; if those are present, the attack is reliable and repeatable.

Remediation

Upgrade Capgo to version 12.128.2 or later. This version includes authorization checks within the public.apply_usage_overage function to validate auth.uid(), verify organization membership, and enforce check_min_rights policies before executing billing operations. The patch ensures the function respects Row Level Security even when running with elevated privileges.

Patch guidance

Deploy version 12.128.2 or newer as soon as feasible. Given the HIGH severity and direct financial impact, this should be treated as a priority patch. Before patching, verify no active automated billing processes depend on direct invocation of public.apply_usage_overage; the patched version enforces authorization, which may cause legitimate automation to fail if those processes lack proper credentials or org context. Test the patched version in a staging environment against your billing workflows to confirm compatibility.

Detection guidance

Monitor Supabase audit logs and PostgreSQL query logs for calls to public.apply_usage_overage originating from unexpected user accounts or roles, particularly those from authenticated users without billing admin privileges. Alert on invocations that modify overage_events or credit balances for organizations not owned by the calling user. Review recent billing history for anomalous credit deductions or overage charges that do not correspond to actual usage; cross-reference with RPC call logs to identify suspicious patterns. Implement strict RBAC and revoke default EXECUTE permissions on sensitive SECURITY DEFINER functions if not explicitly required.

Why prioritize this

This vulnerability scores HIGH (7.6 CVSS) because it enables direct, high-impact manipulation of billing data by authenticated insiders with minimal friction. The combination of low attack complexity, remote network accessibility, and high integrity impact (fraudulent billing) justifies urgent prioritization. While confidentiality impact is lower (auth.uid leakage is possible but not the primary concern), the business criticality of billing integrity and the straightforward exploitation path warrant immediate patching.

Risk score, explained

The CVSS 3.1 score of 7.6 reflects: Attack Vector (Network—the function is accessible via RPC), Attack Complexity (Low—standard API calls), Privileges Required (Low—any authenticated user), User Interaction (None), Scope (Unchanged—impact is limited to Capgo's billing data, not other services), Confidentiality (Low—some user data exposure is possible during billing record access), Integrity (High—billing records can be freely modified), Availability (Low—credits can be depleted, causing service degradation but not complete unavailability). The HIGH severity is driven primarily by the integrity impact on financial data and the ease of exploitation by any authenticated user.

Frequently asked questions