CVE-2026-56213

MEDIUM

Capgo - Unauthenticated Cross-Tenant Metrics Poisoning via upsert_version_meta RPC

Title source: cna

Description

Capgo before 12.128.2 contains an authorization bypass vulnerability in the public.upsert_version_meta SECURITY DEFINER function exposed via PostgREST RPC, allowing unauthenticated attackers to insert arbitrary rows into version_meta for any app_id. Attackers can exploit this by calling the RPC endpoint with a public anon key to poison storage metrics, causing persistent false data in dashboards and triggering incorrect alerts across victim applications.

References (2)

Core 2

Core References

Vendor Advisory vendor-advisory

GHSA Advisory GHSA-g4hx-x8gc-x6rw

https://github.com/Cap-go/capgo/security/advisories/GHSA-g4hx-x8gc-x6rw

Third Party Advisory third-party-advisory

VulnCheck Advisory: Capgo - Unauthenticated Cross-Tenant Metrics Poisoning via upsert_version_meta RPC

https://www.vulncheck.com/advisories/capgo-unauthenticated-cross-tenant-metrics-poisoning-via-upsert-version-meta-rpc

Scores

CVSS v3 5.3

EPSS 0.0035

EPSS Percentile 28.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact partial

Details

CWE

CWE-862

Status published

Products (2)

Capgo/Capgo < 12.128.2

Capgo/Capgo 12.128.2

Published Jun 20, 2026

Tracked Since Jun 20, 2026