Executive brief
Capgo, a backend service for Supabase edge functions, contained a security flaw where certain private data requests did not use the standard security gatekeeper. While the system currently blocks unauthorized access through a secondary check, this inconsistency creates a risk that future updates could accidentally expose sensitive organizational role information. Users should update to the latest version to ensure all private data is protected by uniform security controls.
Technical details
A missing authentication middleware vulnerability (CWE-306) exists in Capgo's Supabase edge functions. Specifically, the GET /private/role_bindings/:org_id endpoint does not utilize the 'middlewareAuth' applied to POST and DELETE methods, allowing unauthenticated requests to reach the function handler directly. While the handler currently performs an internal authorization check that returns an 'Unauthorized' error, the lack of middleware-level enforcement bypasses the standard JWT/API key validation layer. This inconsistency poses a regression risk where future modifications to the handler logic could lead to unauthorized data exposure. The issue is resolved in version 12.128.2.
Affected products
- Capgo Capgo (backend Supabase edge functions) < 12.128.2
Timeline
- 2026-03-03: advisory: GitHub Security Advisory published
- 2026-06-22: disclosed: NVD publication date