Capgo - Unauthenticated Cross-Tenant Disclosure via get_current_plan_max_org RPC
Description
Capgo before 12.128.2 contains an authorization bypass vulnerability in the public.get_current_plan_max_org RPC function that allows unauthenticated attackers to retrieve arbitrary organization plan limits. Attackers can call the RPC endpoint with any organization UUID using only the public Supabase key to disclose billing information including MAU, bandwidth, storage, and build time limits for any organization.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
Root cause
"The PostgREST RPC function `public.get_current_plan_max_org(uuid)` is granted to the `anon` role and does not validate that the caller is authorized for the supplied organization UUID."
Attack vector
An unauthenticated attacker who possesses only the public Supabase anon key (`sb_publishable_*`) can call `POST /rest/v1/rpc/get_current_plan_max_org` with an arbitrary organization UUID. The function performs no authorization check — it does not verify that the caller is a member of the target org via `org_users`, RBAC, or API key restrictions. This allows any party with the public key to retrieve billing plan limits (MAU, bandwidth, storage, build_time_unit) for any org UUID they know or can guess [ref_id=1].
What the fix does
The advisory recommends revoking the public grant: `REVOKE ALL ON FUNCTION public.get_current_plan_max_org(uuid) FROM anon;` and adding an authorization check inside the function (RBAC/org membership/API key org restriction) before returning any data [ref_id=1]. Without these changes, the function remains callable by the `anon` role and will return plan limits for any supplied `orgid` without verifying the caller's relationship to that organization.
Preconditions
- inputAttacker must obtain the public Supabase anon key (sb_publishable_*) for the target project
- inputAttacker must know or guess a valid organization UUID
Generated on Jun 23, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
2- github.com/Cap-go/capgo/security/advisories/GHSA-v3jp-r95g-x4mmmitrevendor-advisory
- www.vulncheck.com/advisories/capgo-unauthenticated-cross-tenant-disclosure-via-get-current-plan-max-org-rpcmitrethird-party-advisory
News mentions
0No linked articles in our index yet.