Executive brief
Capgo, a platform for managing app updates, contained a security flaw that allowed unauthorized individuals to view sensitive billing and usage data for any organization on the platform. By using a publicly available access key, an attacker could see details such as monthly active users, bandwidth usage, and storage limits for other customers. This could lead to the exposure of private business metrics and competitive intelligence.
Technical details
An improper authorization vulnerability exists in Capgo's Supabase-backed RPC function 'public.get_current_plan_max_org'. The function was explicitly granted to the 'anon' role in database migrations without implementing internal RBAC or membership checks. An unauthenticated attacker can invoke this endpoint via the PostgREST API using only a public Supabase publishable key. By providing a target organization's UUID, the attacker can retrieve cross-tenant billing data including MAU, bandwidth, storage, and build time limits. The issue is resolved in version 12.128.2 by revoking public access and implementing proper authorization checks.
Affected products
- Capgo Capgo < 12.128.2
Timeline
- 2026-03-17: advisory: GitHub Security Advisory published
- 2026-06-22: disclosed: NVD publication date