Hunt-With-4Bh1

**Name of the Vulnerable Software and Affected Versions** Capgo versions prior to 12.128.2 **Description** A path traversal issue exists in the builder upload proxy. Authenticated users with build permissions can bypass upload restrictions by appending traversal sequences to the upload path. These sequences are normalized by the WHATWG URL parser, allowing unauthorized access to internal administrative endpoints using the privileged `BUILDER API KEY` header, which leads to server-side privilege escalation. **Recommendations** Update to version 12.128.2 or later.

**Name of the Vulnerable Software and Affected Versions** Capgo versions prior to 12.128.2 **Description** A privilege escalation issue exists in the `public.apply usage overage` function. This function is defined as SECURITY DEFINER, meaning it executes with the privileges of the user who created it, thereby bypassing Row Level Security (RLS). The function performs sensitive billing operations but fails to enforce internal authorization checks, such as validating `auth.uid()`, organization membership, or `check min rights`. If EXECUTE permissions are granted to authenticated or anonymous roles, an authenticated user can invoke the function via Supabase RPC to manipulate billing data for any organization, leading to fraudulent overage event insertion and unauthorized credit depletion. **Recommendations** Update to version 12.128.2 or later. As a temporary workaround, restrict EXECUTE permissions on the `public.apply usage overage` function to prevent unauthorized access by authenticated or anonymous roles.