Executive brief
Capgo, a platform for managing app updates and deployments, contained a security flaw that allowed unauthorized individuals to validate and profile API keys. By exploiting a misconfigured database function, an attacker could confirm if a leaked API key was valid and retrieve sensitive details about its owner, permissions, and expiration. This could lead to unauthorized access to organizational data or the ability to map out a company's internal infrastructure if any API keys were accidentally exposed in logs or code.
Technical details
An information disclosure vulnerability exists in Capgo versions prior to 12.128.2 due to an incorrectly configured PostgreSQL function, 'public.find_apikey_by_value(text)'. The function was marked as SECURITY DEFINER and granted EXECUTE permissions to the 'anon' role, making it accessible via the Supabase RPC endpoint (/rest/v1/rpc/find_apikey_by_value) without authentication. If an attacker provides a valid API key value, the function returns the full row from the 'public.apikeys' table, exposing metadata such as user_id, mode, organization scoping, and expiration dates. This serves as a validation oracle for leaked keys and allows for the enumeration of internal account relationships. The issue was resolved in version 12.128.2 by restricting function execution.
Affected products
- Capgo Capgo < 12.128.2
Timeline
- 2026-03-03: advisory: GitHub Security Advisory published
- 2026-07-11: disclosed: NVD publication date