CVE-2026-56284 Details
Description
Capgo (Cap-go/capgo) before 12.128.2 contains an information disclosure vulnerability in the Supabase PostgREST RPC function public.get_total_metrics(org_id), which is callable by the anon role using only the public sb_publishable_* key. An unauthenticated attacker can probe organization existence and leak sensitive usage metrics including MAU, bandwidth, and install counts by sending POST requests to /rest/v1/rpc/get_total_metrics with valid organization UUIDs.
An information disclosure vulnerability exists in Capgo versions prior to 12.128.2, specifically within the Supabase PostgREST RPC function public.get_total_metrics(org_id). This function can be accessed by the anon role using only the public sb_publishable_* key. Unauthenticated attackers can exploit this vulnerability to probe the existence of organizations and leak sensitive usage metrics such as monthly active users (MAU), bandwidth, and installation counts. The vulnerability is triggered by sending POST requests to /rest/v1/rpc/get_total_metrics with valid organization UUIDs.
To address this vulnerability, remove anonymous access to the public.get_total_metrics function and require authenticated membership checks. If the function must remain public, ensure it returns a constant response shape without exposing sensitive metrics.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 8, 2026CISA-ADP
Assessed Jul 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Cap-go/capgo/security/advisories/GHSA-h5jf-xgvh-hgjw | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/Cap-go/capgo/security/advisories/GHSA-h5jf-xgvh-hgjw | [email protected] | AdvisoryExploitRemedyVendor |
| https://www.vulncheck.com/advisories/capgo-unauthenticated-metrics-disclosure-via-get-total-metrics-rpc | [email protected] | AdvisoryVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Capgo | < 12.128.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 8, 2026 | CVE Modified | CISA-ADP |
| Jul 8, 2026 | New CVE Received | [email protected] |