CVE-2026-56284: Capgo Information Disclosure – Unauthorized Metrics Leakage

Technical summary

The vulnerability exists in the Supabase PostgREST RPC endpoint public.get_total_metrics(org_id), which is accessible via POST requests to /rest/v1/rpc/get_total_metrics using only the publicly available sb_publishable_* API key. The RPC function is exposed to the anon role without proper authorization checks, allowing unauthenticated callers to enumerate valid organization UUIDs and retrieve metrics data (MAU, bandwidth, install counts) associated with those organizations. The root cause is inadequate access control on a function that exposes business-critical aggregates. This is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor).

Business impact

Organizations using Capgo before version 12.128.2 face competitive intelligence leakage and privacy violations. Attackers can map the platform's user base, identify high-value targets by their usage patterns, and infer market activity and growth rates for competing apps. For Capgo customers, this also exposes internal KPIs that should remain confidential, potentially revealing business strategy or performance troubles to competitors. The reputational risk is moderate—competitors or researchers could systematically extract and publish metrics for all known organizations.

Affected systems

Capgo versions prior to 12.128.2 are vulnerable. The vulnerability is backend-centric; it affects the Supabase PostgREST layer and does not require specific client versions to be exploited. Any organization using an affected Capgo instance is at risk if accessed via the public Internet.

Exploitability

Exploitability is very high. The attack requires no authentication, no special network positioning, and minimal technical knowledge—a simple HTTP POST request with a guessed or enumerated organization UUID is sufficient. No user interaction or complex manipulation of application logic is needed. The main constraint is discovering valid organization UUIDs; however, UUIDs can be enumerated or obtained through open-source intelligence (e.g., metadata from app stores, documentation, or brute-force). The CVSS network attack vector (AV:N) and lack of privilege requirement (PR:N, UI:N) reflect this ease of exploitation.

Remediation

Upgrade Capgo to version 12.128.2 or later immediately. The patch adds proper authorization checks to the get_total_metrics RPC function, restricting access to authenticated users with appropriate permissions. No configuration workarounds are available; patching is the only remediation. Organizations should also audit Capgo logs to detect any history of abuse of this endpoint during the exposure window.

Patch guidance

Apply Capgo version 12.128.2 or any subsequent release. Follow your normal deployment and testing procedures. Because the vulnerability is in the backend API layer, patching typically requires redeploying the Capgo service; verify with your deployment documentation whether a service restart is required. Once patched, the anon role will no longer have access to the metrics function. Test the patch by confirming that unauthenticated POST requests to /rest/v1/rpc/get_total_metrics are rejected with a 401 or 403 response.

Detection guidance

Monitor Capgo logs for POST requests to /rest/v1/rpc/get_total_metrics that originate from outside your trusted network or lack valid authentication headers. Alert on repeated or systematic requests with different org_id parameters, which would indicate enumeration or probing. If you do not use this RPC endpoint in your normal operations, any requests to it are suspicious. Check CloudTrail or equivalent audit logs for unusual API calls to Supabase PostgREST. Retrospectively, review access logs for the endpoint during the period before patching to identify if the vulnerability was exploited.

Why prioritize this

Although the CVSS score is moderate (5.3), this vulnerability merits rapid patching because exploitability is trivial and the exposed data is business-sensitive. There are no barriers to attack—no credentials required, no complex logic to bypass—making it an attractive target for competitive intelligence gathering. The information leaked (user counts, bandwidth) is often considered proprietary and its disclosure can cause business and reputational harm. Organizations should deprioritize other patch work to address this one quickly.

Risk score, explained

The CVSS 3.1 score of 5.3 (MEDIUM, AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) correctly reflects a network-accessible flaw requiring no authentication or user interaction, with limited scope (only confidentiality impact, no integrity or availability impact). The 'L' in the confidentiality component acknowledges that sensitive metrics are leaked. The score does not account for business context (competitive harm or reputational damage), which may justify higher internal risk ratings. From a pure technical attack surface perspective, the CVSS score is appropriate; from a business perspective, many organizations would treat this as higher priority due to the ease of exploitation and the sensitivity of usage metrics.

Frequently asked questions