PT-2026-51044 · Cap Go · Cap-Go

Judel777 · Published 2026-06-20 · Updated 2026-06-20 · CVE-2026-56214

Mitre

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Capgo before 12.128.2 contains an information disclosure vulnerability in Supabase PostgREST RPC endpoints is trial org and is paying org that allows unauthenticated attackers to enumerate organizations and disclose billing status using the public sb publishable key. Attackers can invoke these endpoints to determine organization existence via distinguishable return values and identify paying customers for targeted profiling.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-56214

Affected Products

Cap-Go

References · 3

• https://github.com/Cap-go/capgo/security/advisories/GHSA-mh5p-rrhp-442q · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-56214 · Security Note
• https://vulncheck.com/advisories/capgo-unauthenticated-organization-enumeration-and-billing-status-disclosure-via-supabase-rpc · Note