CVE-2026-56245: Supabase Capgo Authorization Bypass Allows Billing Fraud

Technical summary

CVE-2026-56245 is an authorization bypass in the record_build_time RPC function marked with SECURITY DEFINER in Supabase Capgo. The function fails to properly validate caller identity before accepting POST requests to /rest/v1/rpc/record_build_time, allowing unauthenticated access via public API keys. This enables insertion of arbitrary build-time records into the database, which directly poison billing and quota tracking systems. The vulnerability affects data integrity and availability of quota enforcement across multi-tenant deployments. The CVSS 3.1 score of 8.2 (HIGH) reflects a high impact on integrity, some impact on availability, no confidentiality impact, and a network-based attack vector with low complexity and no authentication required.

Business impact

Organizations running affected Supabase Capgo instances face direct financial and operational risk. Attackers can artificially inflate build-time records to trigger billing charges for services not actually consumed, create resource exhaustion conditions by exhausting quotas on behalf of victim tenants, or manipulate usage metrics that feed into cost allocation and SLA tracking. In multi-tenant environments, this enables cross-tenant billing fraud and denial of service. Remediation delays compound exposure as each day of operation allows accumulation of fraudulent records that may take time to audit and reverse.

Affected systems

Supabase Capgo versions before 12.128.2 are affected. Any deployment exposing the /rest/v1/rpc endpoint with this function is vulnerable. Risk is highest in production multi-tenant SaaS environments and private deployments where quotas directly gate resource access or drive billing. Organizations using Capgo for CI/CD build-time tracking and metric collection should prioritize assessment.

Exploitability

Exploitability is high. The attack requires no authentication, no user interaction, and minimal complexity—an attacker simply needs network access to the Capgo API endpoint and knowledge of the function name. A public API key is sufficient to trigger the vulnerable endpoint. Proof-of-concept would involve a single HTTP POST request. The low barrier to exploitation, combined with the public nature of API documentation, makes this vulnerability likely to be discovered and weaponized quickly. No known exploit in the wild is documented, but the attack surface is not hidden.

Remediation

Upgrade Supabase Capgo to version 12.128.2 or later. This version contains authorization fixes that enforce proper authentication and identity validation on the record_build_time RPC function. Organizations should also audit billing and quota records created during the window of exposure to identify and reverse fraudulent entries. Implement additional monitoring on the /rest/v1/rpc endpoint to detect repeated calls from untrusted sources and alert on anomalies in build-time record volume.

Patch guidance

Apply Supabase Capgo 12.128.2 or later to all affected instances. The patch should be validated in a non-production environment first, particularly to confirm that legitimate build-time recording workflows continue to function. Coordinate the upgrade with any dependent CI/CD pipelines that rely on the record_build_time function. Verify vendor release notes and changelogs to confirm the fix addresses the authorization check. Organizations unable to upgrade immediately should consider disabling or restricting access to the /rest/v1/rpc endpoint at the network or API gateway level.

Detection guidance

Monitor for suspicious activity on the record_build_time endpoint by logging all requests to POST /rest/v1/rpc/record_build_time and analyzing patterns such as: high request volume from single sources, requests from unexpected geographic locations or IP ranges, requests using only public API keys without user context, and records with timestamps far in the past or future. Audit billing and quota records for entries that do not correlate with actual CI/CD pipeline executions or developers. Alert if the function is called outside normal business hours or by service accounts with no legitimate reason to invoke it. Implement rate limiting on the RPC endpoint if not already in place.

Why prioritize this

This vulnerability merits immediate attention despite the lack of KEV designation. The combination of zero authentication required, high integrity impact on billing systems, resource availability impact via quota exhaustion, and ease of exploitation creates a critical business risk in multi-tenant and SaaS deployments. The attack directly affects cost control and tenant isolation—core SaaS tenets. Financial impact can accumulate quickly, and forensic cleanup of fraudulent records is expensive. Fast-moving organizations should prioritize this ahead of lower-impact HIGH-severity issues.

Risk score, explained

The CVSS 3.1 score of 8.2 reflects: Attack Vector = Network (no physical access required), Attack Complexity = Low (no special conditions or tools needed), Privileges Required = None (unauthenticated access), User Interaction = None (automated exploitation), Scope = Unchanged (impact confined to the affected system), Confidentiality = None (no data disclosure), Integrity = High (billing and quota records are modified), Availability = Low (quotas can be exhausted, limiting service). The HIGH severity is justified by the direct manipulation of billing and quota data without authentication, though lack of confidentiality impact and limited availability impact prevent a CRITICAL rating. In context of multi-tenant SaaS environments, the actual business risk may warrant treating it as critical for your organization.

Frequently asked questions