What’s Vulnerable › Vulnerabilities

CVE-2026-56284: Capgo - Unauthenticated Metrics Disclosure via get_total_metrics RPC

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-08 · updated 2026-10-25
• Weakness: CWE-200

Description

Capgo (Cap-go/capgo) before 12.128.2 contains an information disclosure vulnerability in the Supabase PostgREST RPC function public.get_total_metrics(org_id), which is callable by the anon role using only the public sb_publishable_* key. An unauthenticated attacker can probe organization existence and leak sensitive usage metrics including MAU, bandwidth, and install counts by sending POST requests to /rest/v1/rpc/get_total_metrics with valid organization UUIDs.

Affected products

• Cap-go capgo: before 12.128.2 — fixed in 12.128.2

How to fix

Upgrade to a fixed version: Cap-go capgo 12.128.2. Check the vendor advisory for mitigations.

References

• https://github.com/Cap-go/capgo/security/advisories/GHSA-h5jf-xgvh-hgjw
• https://www.vulncheck.com/advisories/capgo-unauthenticated-metrics-disclosure-via-get-total-metrics-rpc
• https://github.com/Cap-go/capgo/security/advisories/GHSA-h5jf-xgvh-hgjw

Get alerted when CVE-2026-56284 or the next vulnerability affects your stack