PT-2026-57547

CVE-2026-56238

Published

2026-07-12

Updated

2026-07-12

Description by

CVSS 4.0

8.7

High

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Capgo versions prior to 12.128.2

Description An information disclosure issue exists in the Supabase PostgREST global stats endpoint. Unauthenticated attackers can use the public apikey to query the '/rest/v1/global stats' endpoint, exposing sensitive financial and operational metrics, including Monthly Recurring Revenue (MRR), total revenue, plan-tier revenue breakdown, customer counts, and operational telemetry.

Recommendations Update to version 12.128.2 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Judel777

Vendors

Affected products

Weakness enumeration

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Related identifiers