CVE-2026-56321
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk24th percentile — higher than 24% of all known CVEs
Summary
Capgo (backend of Supabase edge functions) before version 12.128.2 does not apply the global authentication middleware to the GET /private/role_bindings/:org_id endpoint, unlike the POST and DELETE role_bindings routes. This allows unauthenticated requests to reach the handler instead of being rejected at the middleware layer.
Risk Assessment
The risk lies in inconsistent authentication enforcement across different HTTP methods, which could enable authorization bypass if the handler logic changes. Although there is currently no direct data exposure, this flaw could lead to more serious issues in the future.
Recommendation
It is recommended to upgrade to version 12.128.2 or later to ensure consistent authorization enforcement across all HTTP methods. Additionally, reviewing the handler logic is advisable to ensure there are no other potential vulnerabilities.
Original NVD description (English source)
Capgo (backend Supabase edge functions) before 12.128.2 does not apply the global authentication middleware to the GET /private/role_bindings/:org_id endpoint, unlike the POST and DELETE role_bindings routes, so unauthenticated requests reach the handler instead of being rejected at the middleware layer. The handler still performs its own authorization check and returns Unauthorized, so no direct data exposure occurs; the flaw is inconsistent authentication enforcement across HTTP methods that could enable authorization bypass if the handler logic changes.