PT-2026-51769 · Cap Go+1 · Cap-Go+1
CVSS v4.0
7.1
High
| Vector | AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Capgo versions prior to 12.128.2
Description
Insufficient row-level security policies on the webhooks table allow non-admin API keys to read webhook signing secrets via the Supabase REST API. This allows attackers to retrieve the webhook secret and forge valid
X-Capgo-Signature headers to send authenticated webhook events to configured receivers, compromising the authenticity and integrity of the webhooks.Recommendations
Update to version 12.128.2 or later.
Exploit
Fix
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Cap-Go
Supabase