CVE-2026-56239
HighCVSS 7.6Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
Capgo before version 12.128.2 contains a potential privilege escalation vulnerability in the public.apply_usage_overage SECURITY DEFINER function, which performs sensitive billing operations without enforcing internal authorization checks. The function runs with the owner's privileges, bypassing Row Level Security.
Risk Assessment
This vulnerability allows an authenticated user to manipulate billing data for arbitrary organizations, potentially leading to unauthorized credit depletion and fraudulent overage event insertion.
Recommendation
It is recommended to upgrade to version 12.128.2 or later to mitigate this vulnerability. Additionally, consider restricting access to the public.apply_usage_overage function for authenticated and anon roles.
Original NVD description (English source)
Capgo before 12.128.2 contains a potential privilege escalation vulnerability in the public.apply_usage_overage SECURITY DEFINER function, which performs sensitive billing operations without enforcing internal authorization checks (no validation of auth.uid(), org membership, or check_min_rights). Because the function runs with the owner's privileges, it bypasses Row Level Security. If EXECUTE permission is available to the authenticated or anon roles (explicitly or via default privileges), an authenticated user could invoke it via Supabase RPC to manipulate billing data for arbitrary organizations, including unauthorized credit depletion and fraudulent overage event insertion.