CVE-2026-56311: Capgo Authorization Bypass Exposes Organization Billing Data

Technical summary

CVE-2026-56311 is an authorization bypass in Capgo's public.get_current_plan_max_org RPC function. The vulnerability stems from improper access controls on an administrative endpoint that should require authentication. The function accepts an organization UUID parameter and returns plan limits without validating that the caller has legitimate access to that organization. Attackers can invoke the endpoint using only the public Supabase API key, which is intentionally distributable as part of the application's client-side configuration. The affected versions prior to 12.128.2 fail to implement row-level security (RLS) policies or equivalent authorization checks, making all organizations' billing metadata queryable by unauthenticated clients.

Business impact

This vulnerability enables competitive intelligence gathering and informed targeting of rival organizations. Threat actors can systematically enumerate organization UUIDs and map their resource allocation strategies, growth patterns, and infrastructure capacity. For organizations using Capgo, unauthorized disclosure of plan limits could reveal operational scale, anticipated growth, and budget constraints to external parties. This information can inform social engineering campaigns, pricing negotiations, or strategic business decisions made by competitors. The exposure is particularly sensitive for early-stage companies or those operating in competitive markets where usage metrics indicate market traction.

Affected systems

Capgo versions prior to 12.128.2 are affected. The vulnerability impacts all organizations whose metadata was queryable during the vulnerable period. There are no platform restrictions—any Internet-connected system with the public Supabase key for a Capgo-powered application can exploit this vulnerability. Hosted instances of Capgo and self-hosted deployments are equally affected if running vulnerable versions.

Exploitability

Exploitability is high from a technical standpoint. The attack requires no authentication, no user interaction, and no special network access—only standard HTTPS connectivity and knowledge of a target organization's UUID. An attacker can write a simple script to enumerate UUIDs and extract plan data in bulk. However, the practical impact per-organization is limited to information disclosure rather than system compromise, access, or modification. The CVSS score of 5.3 (Medium) reflects this: low attack complexity and no authentication requirements offset by confidentiality impact only.

Remediation

Upgrade Capgo to version 12.128.2 or later immediately. The patch adds proper authorization checks to the get_current_plan_max_org function, ensuring that only authenticated users with legitimate access to an organization can view its plan details. Verify the upgrade is applied across all instances—both SaaS and self-hosted deployments. No configuration changes are required post-upgrade; the fix is automatic.

Patch guidance

Apply Capgo version 12.128.2 or later. Consult the official Capgo release notes and vendor advisory to confirm the exact patch version, installation steps, and any compatibility notes for your deployment architecture. If running self-hosted Capgo, rebuild and redeploy using the patched version. SaaS customers should check with their Capgo provider to confirm patch status; most managed services auto-update, but verification is prudent.

Detection guidance

Monitor RPC logs for unexpected calls to the public.get_current_plan_max_org endpoint, particularly from non-authenticated sessions or IPs outside your organization. High-volume or systematic calls to this function with varying organization UUIDs may indicate reconnaissance. Review Supabase audit logs for the relevant time window to identify what organization data was accessed and from which IP addresses. If you cannot determine your Capgo version, check your deployment manifest or contact your provider. Correlate any detected exploitation with downstream business intelligence gathering or social engineering incidents.

Why prioritize this

Medium severity warrants swift but not emergency action. The lack of KEV status and absence from active exploitation tracking suggests no current widespread weaponization, reducing immediate risk. However, the ease of exploitation and the sensitivity of billing metadata justify timely patching within your standard maintenance windows. Prioritize this if your organization competes in sensitive markets or if you operate multiple Capgo instances.

Risk score, explained

The CVSS 5.3 (Medium) score reflects an unauthenticated, low-complexity attack with network access and confidentiality impact, but no integrity or availability impact. The vulnerability does not enable further system compromise directly; it is an information disclosure vector. The score is appropriate for a data leak without active exploit availability. Internal risk assessment should factor in your competitive sensitivity and the volume of organizations you host or operate.

Frequently asked questions