CVE-2026-56245

Description

Supabase Capgo before 12.128.2 contains an authorization bypass vulnerability in the SECURITY DEFINER record_build_time RPC function that allows unauthenticated attackers to insert arbitrary build-time records. Attackers can exploit this by calling POST /rest/v1/rpc/record_build_time with a public API key to poison billing and quota data for any organization, enabling resource exhaustion and cross-tenant billing manipulation.

CVSS Vector

References

• https://github.com/Cap-go/capgo/security/advisories/GHSA-42f8-v563-5763
• https://www.vulncheck.com/advisories/supabase-capgo-unauthenticated-cross-tenant-build-time-accounting-poisoning-via-record-build-time-rpc
• https://github.com/Cap-go/capgo/security/advisories/GHSA-42f8-v563-5763