Privilege Escalation Vulnerability in Capgo Billing Function

CVE-2026-56239

What is CVE-2026-56239?

A privilege escalation vulnerability exists in Capgo's public.apply_usage_overage SECURITY DEFINER function, allowing unauthorized actions in billing processes. This function lacks necessary internal authorization checks and runs with the owner's privileges, bypassing Row Level Security. If users possess EXECUTE permission, they can exploit Supabase RPC to alter billing information across organizations. This could lead to unauthorized credit depletion and fraudulent events, posing significant risks to data integrity and security.

References