Capgo - Missing Authentication Middleware on GET /private/role_bindings Endpoint
Description
Capgo (backend Supabase edge functions) before 12.128.2 does not apply the global authentication middleware to the GET /private/role_bindings/:org_id endpoint, unlike the POST and DELETE role_bindings routes, so unauthenticated requests reach the handler instead of being rejected at the middleware layer. The handler still performs its own authorization check and returns Unauthorized, so no direct data exposure occurs; the flaw is inconsistent authentication enforcement across HTTP methods that could enable authorization bypass if the handler logic changes.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
Root cause
"Missing application of the global authentication middleware to the GET /private/role_bindings/:org_id endpoint."
Attack vector
An attacker sends an HTTP GET request to `/functions/v1/private/role_bindings/:org_id` without any `Authorization` header. Because the global authentication middleware is not applied to this route, the request reaches the handler, which returns `{"error":"Unauthorized"}`. While no data is currently exposed, the inconsistent enforcement across HTTP methods [ref_id=1] creates a latent authorization bypass risk if the handler logic is ever modified.
Affected code
The GET route in `supabase/functions/_backend/private/role_bindings.ts` is not wrapped with `middlewareAuth`, unlike the POST and DELETE routes for the same resource. This means unauthenticated requests reach the handler instead of being rejected at the middleware layer.
What the fix does
The advisory recommends applying `middlewareAuth` to the GET route, either via `app.use('/', middlewareAuth)` or by wrapping the GET handler explicitly. This would align the GET route with the POST and DELETE routes, ensuring unauthenticated requests are rejected at the middleware layer before reaching the handler, eliminating the inconsistency and reducing the risk of future authorization bypass.
Preconditions
- networkNo Authorization header is required; the attacker simply sends a GET request to the vulnerable endpoint.
- inputThe attacker must know a valid org ID to include in the URL path.
Generated on Jun 23, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
2- github.com/Cap-go/capgo/security/advisories/GHSA-6c9f-9v99-26wwmitrevendor-advisory
- www.vulncheck.com/advisories/capgo-missing-authentication-middleware-on-get-private-role-bindings-endpointmitrethird-party-advisory
News mentions
0No linked articles in our index yet.