Executive brief
Capgo, a platform for managing app updates and billing, contained a security flaw in its billing management system. An authenticated user could exploit this flaw to manipulate the billing records of other organizations, potentially leading to unauthorized credit depletion or fraudulent charges. This could result in financial loss for customers and damage to the platform's reputation regarding data integrity and billing accuracy.
Technical details
A privilege escalation vulnerability exists in Capgo versions prior to 12.128.2 within the 'public.apply_usage_overage' PostgreSQL function. The function is defined with the SECURITY DEFINER attribute, meaning it executes with the privileges of the database owner and bypasses Row Level Security (RLS). Because the function lacks internal authorization checks—such as validating the caller's identity (auth.uid()) or organizational membership—an authenticated attacker can invoke it via Supabase RPC. By supplying a target organization's UUID, an attacker can insert fraudulent overage events or deplete credits for arbitrary organizations. The issue is resolved in version 12.128.2 by implementing proper authorization checks and restricting execution permissions.
Affected products
- Capgo Capgo < 12.128.2
Timeline
- 2026-02-26: advisory: GitHub Security Advisory published
- 2026-06-21: disclosed: NVD publication date