PT-2026-57547 · Cap Go · Cap-Go

Judel777 · Publicado 2026-07-12 · Atualizado 2026-07-12 · CVE-2026-56238

NVD

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Capgo before 12.128.2 contains an information disclosure vulnerability in the Supabase PostgREST global stats endpoint that allows unauthenticated attackers to read sensitive financial and operational metrics using only the public apikey. Remote attackers can query the /rest/v1/global stats endpoint to expose MRR, total revenue, plan-tier revenue breakdown, customer counts, and operational telemetry.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2026-56238

Produtos afetados

Cap-Go

Referências · 3

• https://github.com/Cap-go/capgo/security/advisories/GHSA-73rv-fpp7-r3r4 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-56238 · Nota de Segurança
• https://vulncheck.com/advisories/capgo-unauthenticated-information-disclosure-via-postgrest-global-stats-endpoint · Nota