Unauthenticated Denial-of-Service Vulnerability in Capgo Backend by Cap-go

CVE-2026-56248

What is CVE-2026-56248?

A significant vulnerability in the capgo backend allows for unauthenticated denial-of-service attacks due to a flaw in the Row-Level Security (RLS) policy of the audit_logs table. When accessed via the Supabase PostgREST API, unfiltered queries can lead to excessive resource consumption as the PostgreSQL query planner executes expensive logic before triggering RLS rejections. This results in statement timeouts and, under concurrent usage, can deplete database resources, causing cascading failures across unrelated application endpoints and impairing overall service availability.

References