Executive brief
Cap-go is an open-source backend service used for managing app updates and configurations. A vulnerability in how the system handles audit log requests allows an unauthenticated attacker to crash the service or make it unresponsive. By sending specific requests that overwhelm the database, an attacker can cause a total service outage, preventing legitimate users from accessing their accounts or organizations.
Technical details
The vulnerability exists in the public.audit_logs table's Row-Level Security (RLS) policy. When accessed via the Supabase PostgREST API using a public anonymous key, the PostgreSQL query planner executes resource-intensive logic before the RLS policy rejects the unauthorized request. An attacker can send unfiltered queries to the audit_logs endpoint to trigger statement timeouts (error 57014). Under concurrent load, this exhausts database resources, leading to cascading HTTP 500 failures across unrelated endpoints such as /orgs. The issue is resolved in version 12.128.12.
Affected products
- Cap-go capgo-backend < 12.128.12
Timeline
- 2026-05-08: advisory: Original GitHub Security Advisory published
- 2026-06-23: disclosed: CVE published to NVD