CVE-2026-56284: Cap-Go Capgo

Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days.

Capgo (Cap-go/capgo) before 12.128.2 contains an information disclosure vulnerability in the Supabase PostgREST RPC function public.get_total_metrics(org_id), which is callable by the anon role using only the public sb_publishable_* key. An unauthenticated attacker can probe organization existence and leak sensitive usage metrics including MAU, bandwidth, and install counts by sending POST requests to /rest/v1/rpc/get_total_metrics with valid organization UUIDs.

Affected products

• Cap-Go Capgo: before 12.128.2 (fixed in 12.128.2)

Published 2026-07-08. Last modified 2026-07-08.