CVE-2026-56284

Summary

Capgo (Cap-go/capgo) before 12.128.2 contains an information disclosure vulnerability in the Supabase PostgREST RPC function public.get_total_metrics(org_id), which is callable by the anon role using only the public sb_publishable_* key. An unauthenticated attacker can probe organization existence and leak sensitive usage metrics including MAU, bandwidth, and install counts by sending POST requests to /rest/v1/rpc/get_total_metrics with valid organization UUIDs.

Affected Software

Weaknesses

• CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: yes
  • Technical Impact: partial

Additional References

• https://github.com/Cap-go/capgo/security/advisories/GHSA-h5jf-xgvh-hgjw

References

• https://github.com/Cap-go/capgo/security/advisories/GHSA-h5jf-xgvh-hgjw
• https://www.vulncheck.com/advisories/capgo-unauthenticated-metrics-disclosure-via-get-total-metrics-rpc

• ←Previous
• Next→