Skip to content
Threat Feed
Subscribe

Tag

Supabase

3 briefs RSS
high advisory

Information Disclosure in Capgo Supabase Integration via RPC Function

An information disclosure vulnerability in Capgo (Cap-go/capgo) before version 12.128.2 allows unauthenticated attackers to enumerate organization existence. This flaw resides within the Supabase PostgREST SECURITY DEFINER RPC function 'public.rescind_invitation', which returns distinct error messages (NO_ORG vs. NO_RIGHTS) when called with only a publishable API key. This enables attackers to discover valid organization IDs, increasing the attack surface for targeted phishing or social engineering campaigns.

Cap-go/capgo information-disclosure vulnerability supabase
2t 1c
high advisory

CVE-2026-56238 - Capgo Supabase PostgREST Information Disclosure

An information disclosure vulnerability (CVE-2026-56238) in Capgo before 12.128.2's Supabase PostgREST global_stats endpoint allows unauthenticated attackers to retrieve sensitive financial and operational metrics using a public API key.

Capgo < 12.128.2 +1 information-disclosure web-application vulnerability supabase
1r 2t 1c
high advisory

CVE-2026-56226 - Capgo Unauthenticated Data Exposure via Supabase PostgREST RPC

CVE-2026-56226 details a high-severity vulnerability in Capgo versions prior to 12.128.2 that exposes a Supabase PostgREST RPC function, `public.get_orgs_v6`, to unauthenticated attackers, allowing them to retrieve sensitive user organization membership and PII by supplying an arbitrary user UUID.

Capgo vulnerability api-exploitation data-exfiltration webserver supabase
1r 2t 1c