Executive brief
Capgo, a platform for managing app updates, contained a security flaw that allowed unauthorized individuals to view sensitive business data. By using a publicly available key, an attacker could identify if specific organizations were using the service and access their private usage statistics, such as monthly active users, bandwidth consumption, and total app installations. This information could be used by competitors or malicious actors to gain insights into a company's operations and growth.
Technical details
An information disclosure vulnerability exists in Capgo versions prior to 12.128.2 due to improper access control on the Supabase PostgREST RPC function 'public.get_total_metrics(org_id)'. This function was incorrectly accessible to the 'anon' role using only a public 'sb_publishable' key. An unauthenticated remote attacker can send POST requests to the '/rest/v1/rpc/get_total_metrics' endpoint with a valid organization UUID to retrieve sensitive metrics including Monthly Active Users (MAU), bandwidth usage, and installation counts. Additionally, the endpoint acts as an existence oracle, returning an empty array for invalid UUIDs and a populated metrics object for valid ones. The issue was resolved in version 12.128.2 by restricting access to the function.
Affected products
- Capgo capgo < 12.128.2
Timeline
- 2026-03-03: advisory: GitHub Security Advisory published
- 2026-07-08: disclosed: NVD publication date