Authorization Bypass in Cap-go Product Affects Supabase API Functionality
CVE-2026-56235

6.9MEDIUM

Key Information:

Vendor

Cap-go

Status
Capgo
Vendor
CVE Published:
20 June 2026

What is CVE-2026-56235?

The Cap-go software before version 12.128.2 has a significant security flaw that allows an attacker to bypass authorization controls across several RPC functions within Supabase. This vulnerability exposes critical telemetry data, enabling an unauthenticated individual to exploit the public Supabase API key for unauthorized access. Attackers can leverage this oversight to reveal cross-tenant usage metrics, enumerate application IDs, and validate the existence of organizations, thereby creating serious risks to organizational privacy and data integrity.

Affected Version(s)

capgo 0 < 12.128.2

capgo 12.128.2

References

https://github.com/Cap-go/capgo/security/advisories/GHSA-...
vendor-advisory
https://www.vulncheck.com/advisories/capgo-unauthenticate...
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Judel777
.