PT-2026-51040 · Cap Go · Cap-Go

Judel777 · Published 2026-06-19 · Updated 2026-06-19 · CVE-2026-56082

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Capgo versions prior to 12.128.2

Description Improper access control exists in the SECURITY DEFINER PostgREST RPC function public.record build time(). This function is granted to the anon role and can be called using only the public Supabase publishable sb publishable * anon key. An unauthenticated attacker can insert rows into public.build logs for arbitrary organizations. Since the function utilizes ON CONFLICT (build id, org id) DO UPDATE, an attacker can overwrite existing usage and billing records by reusing the same build id for a target organization. This allows for cross-tenant tampering of billing build logs and a financial-impact denial of service by inflating billable build time.

Recommendations Update to version 12.128.2 or later.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2026-56082

Affected Products

Cap-Go

References · 4

• https://github.com/Cap-go/capgo/security/advisories/GHSA-42xj-3h9w-26h5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-56082 · Security Note
• https://vulncheck.com/advisories/supabase-unauthenticated-cross-tenant-billing-log-tampering-via-public-record-build-time-rpc · Note
• https://twitter.com/VulmonFeeds/status/2068114033580847161 · Twitter Post