CVE-2026-56284

Weakness

Capgo (Cap-go/capgo) before 12.128.2 contains an information disclosure vulnerability in the Supabase PostgREST RPC function public.get_total_metrics(org_id), which is callable by the anon role using only the public sb_publishable_* key. An unauthenticated attacker can probe organization existence and leak sensitive usage metrics including MAU, bandwidth, and install counts by sending POST requests to /rest/v1/rpc/get_total_metrics with valid organization UUIDs.

References

• https://github.com/Cap-go/capgo/security/advisories/GHSA-h5jf-xgvh-hgjw
• https://www.vulncheck.com/advisories/capgo-unauthenticated-metrics-disclosure-via-get-total-metrics-rpc
• https://github.com/Cap-go/capgo/security/advisories/GHSA-h5jf-xgvh-hgjw