CVE-2026-56239

Name of the Vulnerable Software and Affected Versions Capgo versions prior to 12.128.2

Description A privilege escalation issue exists in the public.apply usage overage function. This function is defined as SECURITY DEFINER, meaning it executes with the privileges of the user who created it, thereby bypassing Row Level Security (RLS). The function performs sensitive billing operations but fails to enforce internal authorization checks, such as validating auth.uid(), organization membership, or check min rights. If EXECUTE permissions are granted to authenticated or anonymous roles, an authenticated user can invoke the function via Supabase RPC to manipulate billing data for any organization, leading to fraudulent overage event insertion and unauthorized credit depletion.

Recommendations Update to version 12.128.2 or later. As a temporary workaround, restrict EXECUTE permissions on the public.apply usage overage function to prevent unauthorized access by authenticated or anonymous roles.