Information Disclosure in Capgo via Supabase PostgREST

Executive Summary

CVE-2026-56238 is an information disclosure vulnerability in Capgo versions before 12.128.2. It exists in the Supabase PostgREST global_stats endpoint, which allows unauthenticated attackers to access sensitive financial and operational data by querying the /rest/v1/global_stats endpoint using only the public API key.

• Attackers can read Monthly Recurring Revenue (MRR), total revenue, revenue breakdown by plan tiers, customer counts, and operational telemetry.
• The vulnerability arises due to improper access controls allowing anonymous users to access the public.global_stats table.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized disclosure of sensitive financial and operational metrics of your platform.

• Competitors or attackers could gather competitive intelligence such as revenue figures and customer counts.
• Attackers could assess your platform's scale and usage patterns through exposed telemetry data.
• Such exposure could damage business confidentiality and strategic positioning.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by attempting to query the vulnerable endpoint /rest/v1/global_stats using the public API key without authentication. If the query returns sensitive financial and operational metrics such as MRR, total revenue, plan-tier revenue breakdown, customer counts, or operational telemetry, the system is vulnerable.

A simple command to test this could be using curl to send a GET request to the endpoint with the public API key, for example:

• curl -H "apikey: <public_api_key>" https://<your-capgo-instance>/rest/v1/global_stats

If the response contains sensitive data without requiring authentication, the vulnerability is present.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include revoking public access to the global_stats table to prevent unauthenticated queries.

Implementing row-level security (RLS) on the global_stats table is recommended to restrict access to authorized users only.

Alternatively, serve the metrics through an authenticated or admin-only API endpoint, and redact sensitive data if necessary.

Additionally, upgrading Capgo to version 12.128.2 or later, where this vulnerability is fixed, is advised.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows unauthenticated attackers to access sensitive financial and operational data without authorization, which indicates improper access control and exposure of sensitive information.

Such unauthorized disclosure of sensitive data could potentially lead to non-compliance with standards and regulations that require protection of sensitive information, such as GDPR and HIPAA, especially if the exposed data includes personal or financial information covered under these regulations.

The vulnerability arises from public access to the global_stats table without proper access controls, which is a failure to implement adequate security measures required by many compliance frameworks.

Useful 0 Not Useful 0