CVE-2026-56311 Details

An authorization bypass vulnerability has been identified in Capgo versions prior to 12.128.2. The issue resides in the public.get_current_plan_max_org RPC function, which is accessible to unauthenticated users via the public Supabase key. This vulnerability allows attackers to retrieve organization plan limits, including monthly active users (MAU), bandwidth, storage, and build time limits, for any organization by simply knowing its UUID. The function does not validate the caller's authorization or membership in the target organization, leading to unauthorized cross-tenant information disclosure.

To address this vulnerability, revoke public access to the get_current_plan_max_org function for the anon role and implement an authorization check to ensure that only authorized users can access the data.