Improper Access Control Vulnerability in Capgo Product Affecting Supabase

CVE-2026-56082

What is CVE-2026-56082?

Capgo prior to version 12.128.2 has a vulnerability in the SECURITY DEFINER PostgREST RPC function named public.record_build_time. This function, which is accessible with only the public Supabase publishable anon key, grants the anon role the ability to insert rows into the public.build_logs. An unauthenticated attacker can exploit this flaw to tamper with billing records of arbitrary organizations by reusing existing build IDs, leading to significant implications for billing accuracy and potential financial losses through inflated build time logging.

References