High severity7.1NVD Advisory· Published Jun 24, 2026· Updated Jun 25, 2026
CVE-2026-56244
CVE-2026-56244
Description
Capgo before 12.128.2 allows non-admin API keys to read webhook signing secrets via Supabase REST due to insufficient row-level security policies on the webhooks table. Attackers can retrieve the webhook secret and forge valid X-Capgo-Signature headers to send authenticated webhook events to configured receivers, breaking webhook authenticity and integrity.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2Patches
Vulnerability mechanics
References
2News mentions
1- Capgo: 25 CVEs Disclosed in Single Batch — Auth Bypasses, SQLi, and Missing RLSVypr Intelligence · Jun 24, 2026