CVE-2026-56238 Details
Description
Capgo before 12.128.2 contains an information disclosure vulnerability in the Supabase PostgREST global_stats endpoint that allows unauthenticated attackers to read sensitive financial and operational metrics using only the public apikey. Remote attackers can query the /rest/v1/global_stats endpoint to expose MRR, total revenue, plan-tier revenue breakdown, customer counts, and operational telemetry.
An information disclosure vulnerability has been identified in Capgo versions prior to 12.128.2. This vulnerability allows unauthenticated attackers to access sensitive financial and operational metrics through the Supabase PostgREST global_stats endpoint, using only the public apikey. The exposed data includes monthly recurring revenue (MRR), total revenue, a breakdown of revenue by plan tier, customer counts, and operational telemetry.
To address this vulnerability, revoke anonymous access to the public.global_stats endpoint and ensure that Row Level Security (RLS) does not permit public reads. If global metrics are necessary, consider providing them through an authenticated or admin-only API endpoint, or publish a redacted subset.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 12, 2026CISA-ADP
Assessed Jul 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Cap-go/capgo/security/advisories/GHSA-73rv-fpp7-r3r4 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/Cap-go/capgo/security/advisories/GHSA-73rv-fpp7-r3r4 | [email protected] | AdvisoryExploitRemedyVendor |
| https://www.vulncheck.com/advisories/capgo-unauthenticated-information-disclosure-via-postgrest-global-stats-endpoint | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Capgo | < 12.128.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 13, 2026 | CVE Modified | CISA-ADP |
| Jul 12, 2026 | New CVE Received | [email protected] |