CVE-2026-56321 Details

A vulnerability exists in Capgo (backend Supabase edge functions) versions prior to 12.128.2, where the global authentication middleware is not applied to the GET /private/role_bindings/:org_id endpoint. This omission allows unauthenticated requests to reach the handler, in contrast to the POST and DELETE role_bindings routes, which are properly protected. Although the handler conducts its own authorization check and responds with 'Unauthorized', this flaw creates an inconsistent authentication enforcement across HTTP methods. Such inconsistency could lead to an authorization bypass if the handler's logic is altered.

Update Capgo to version 12.128.2 or later, and ensure that the GET /private/role_bindings/:org_id endpoint is protected with the global authentication middleware, either by applying middleware at the route level or wrapping the route explicitly with the authentication logic.