CVE-2026-56245 Details
Description
Supabase Capgo before 12.128.2 contains an authorization bypass vulnerability in the SECURITY DEFINER record_build_time RPC function that allows unauthenticated attackers to insert arbitrary build-time records. Attackers can exploit this by calling POST /rest/v1/rpc/record_build_time with a public API key to poison billing and quota data for any organization, enabling resource exhaustion and cross-tenant billing manipulation.
An authorization bypass vulnerability has been identified in Supabase Capgo versions prior to 12.128.2. The issue resides in the SECURITY DEFINER record_build_time RPC function, which allows unauthenticated attackers to insert arbitrary build-time records. Exploitation involves calling POST /rest/v1/rpc/record_build_time with a public API key, targeting the build_logs table for any organization. This vulnerability can poison billing and quota data, leading to resource exhaustion and cross-tenant billing manipulation.
Users are advised to update to Supabase Capgo version 12.128.2 or later. For those managing Supabase projects, consider removing anonymous grants for the record_build_time function and implementing authorization checks to verify user rights before allowing data modifications. Additionally, rate limiting or abuse controls can be applied if the endpoint needs to remain accessible.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 24, 2026CISA-ADP
Assessed Jun 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Cap-go/capgo/security/advisories/GHSA-42f8-v563-5763 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/Cap-go/capgo/security/advisories/GHSA-42f8-v563-5763 | [email protected] | AdvisoryExploitRemedyVendor |
| https://www.vulncheck.com/advisories/supabase-capgo-unauthenticated-cross-tenant-build-time-accounting-poisoning-via-record-build-time-rpc | [email protected] | AdvisoryBundle |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-269 | Improper Privilege Management | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Supabase Capgo | < 12.128.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 24, 2026 | CVE Modified | CISA-ADP |
| Jun 24, 2026 | New CVE Received | [email protected] |