CVE-2026-100616

Name of the Vulnerable Software and Affected Versions capgo.app (affected versions not specified)

Description An issue exists in the row-level security UPDATE policy on the public.orgs table. An authenticated organization administrator with org.update settings permissions can bypass the official organization update endpoint supabase/functions/ backend/public/organization/put.ts and the private Stripe billing route by sending an update directly to Supabase PostgREST. This allows the user to modify the internal billing pointer column customer id, even without the org.update billing permission. By nulling or corrupting this value, the user can cause plan and billing checks to fail, effectively moving the organization from a paid plan to an unpaid or no-plan state.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.