Executive brief
Capgo, a platform for managing app updates, contained a security flaw in its database interface that allowed unauthorized individuals to verify the validity of API keys. By exploiting this, an attacker could identify the specific user associated with a key and subsequently access private organization details and management email addresses. This could lead to the exposure of sensitive customer data and facilitate targeted phishing or account takeover attempts.
Technical details
The vulnerability exists in the 'get_identity_apikey_only' RPC function, which was incorrectly configured as a SECURITY DEFINER and granted 'ALL' permissions to the 'anon' (anonymous) role. An unauthenticated attacker can call this endpoint via the Supabase REST API to determine if a specific API key is valid (returning a UUID) or invalid (returning null). The resulting user UUID can then be used as an input for other exposed functions, such as 'get_orgs_v6', to leak organization memberships and management email PII. The issue was addressed in version 12.128.2 by revoking anonymous access and tightening default function privileges.
Affected products
- Capgo Capgo < 12.128.2
Timeline
- 2026-03-17: advisory: GitHub Security Advisory published
- 2026-06-21: disclosed: NVD publication date