CVE-2026-56321

Name of the Vulnerable Software and Affected Versions Capgo (backend Supabase edge functions) versions prior to 12.128.2

Description Inconsistent authentication enforcement exists across HTTP methods. The global authentication middleware is not applied to the 'GET /private/role bindings/:org id' endpoint, whereas it is applied to the POST and DELETE routes for role bindings. This allows unauthenticated requests to reach the handler instead of being rejected at the middleware layer. Although the handler performs its own authorization check and returns an Unauthorized response, preventing direct data exposure, this inconsistency could lead to an authorization bypass if the handler logic is modified.

Recommendations Update Capgo (backend Supabase edge functions) to version 12.128.2 or later.