CVE-2026-56245

Summary

Supabase Capgo before 12.128.2 contains an authorization bypass vulnerability in the SECURITY DEFINER record_build_time RPC function that allows unauthenticated attackers to insert arbitrary build-time records. Attackers can exploit this by calling POST /rest/v1/rpc/record_build_time with a public API key to poison billing and quota data for any organization, enabling resource exhaustion and cross-tenant billing manipulation.

Affected Software

Weaknesses

• CWE-269: Improper Privilege Management

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: yes
  • Technical Impact: partial

Additional References

• https://github.com/Cap-go/capgo/security/advisories/GHSA-42f8-v563-5763

References

• https://github.com/Cap-go/capgo/security/advisories/GHSA-42f8-v563-5763
• https://www.vulncheck.com/advisories/supabase-capgo-unauthenticated-cross-tenant-build-time-accounting-poisoning-via-record-build-time-rpc

• ←Previous
• Next→