Inconsistent Authentication Enforcement in Capgo Backend Supabase Edge Functions

CVE-2026-56321

What is CVE-2026-56321?

An inconsistency in the authentication enforcement on the GET /private/role_bindings/:org_id endpoint in Capgo's Supabase edge functions, prior to version 12.128.2, allows unauthenticated requests to reach the handler directly. Unlike the POST and DELETE methods which enforce global authentication middleware, the GET request circumvents this security layer. Although the handler itself checks for authorization and can return an Unauthorized response, the potential for authorization bypass exists if changes are made to the handler logic. This vulnerability highlights the importance of consistent authentication across all HTTP methods to prevent unauthorized access.

References