PT-2026-51043 · Cap Go · Cap-Go

Judel777 · Publicado 2026-06-20 · Atualizado 2026-06-20 · CVE-2026-56213

Mitre

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Capgo before 12.128.2 contains an authorization bypass vulnerability in the public.upsert version meta SECURITY DEFINER function exposed via PostgREST RPC, allowing unauthenticated attackers to insert arbitrary rows into version meta for any app id. Attackers can exploit this by calling the RPC endpoint with a public anon key to poison storage metrics, causing persistent false data in dashboards and triggering incorrect alerts across victim applications.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-56213

Produtos afetados

Cap-Go

Referências · 3

• https://github.com/Cap-go/capgo/security/advisories/GHSA-g4hx-x8gc-x6rw · Aviso do Fabricante
• https://vulncheck.com/advisories/capgo-unauthenticated-cross-tenant-metrics-poisoning-via-upsert-version-meta-rpc · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-56213 · Nota de Segurança