CVE-2026-56248

Name of the Vulnerable Software and Affected Versions Cap-go capgo (capgo-backend) versions prior to 12.128.12

Description An unauthenticated denial-of-service issue exists due to the Row-Level Security (RLS) policy of the audit logs table when accessed through the Supabase PostgREST API. The PostgreSQL query planner executes expensive logic before the RLS policy rejects the request. Consequently, unfiltered queries sent to the 'public.audit logs' endpoint using the public anon key trigger statement timeouts. Under concurrent load, this exhausts database resources and leads to cascading HTTP 500 failures on other endpoints, such as '/orgs', causing an application-layer denial of service.

Recommendations Update to version 12.128.12 or later.