PT-2026-57547 · Supabase+1 · Postgres+1
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Capgo versions prior to 12.128.2
Description
An information disclosure issue exists in the Supabase PostgREST
global stats endpoint. Unauthenticated attackers can use the public apikey to query the '/rest/v1/global stats' endpoint, exposing sensitive financial and operational metrics, including Monthly Recurring Revenue (MRR), total revenue, plan-tier revenue breakdown, customer counts, and operational telemetry.Recommendations
Update to version 12.128.2 or later.
Exploit
Fix
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Cap-Go
Postgres