CVE-2026-56239

Capgo before 12.128.2 contains a potential privilege escalation vulnerability in the public.apply_usage_overage SECURITY DEFINER function, which performs sensitive billing operations without enforcing internal authorization checks (no validation of auth.uid(), org membership, or check_min_rights). Because the function runs with the owner's privileges, it bypasses Row Level Security. If EXECUTE permission is available to the authenticated or anon roles (explicitly or via default privileges), an authenticated user could invoke it via Supabase RPC to manipulate billing data for arbitrary organizations, including unauthorized credit depletion and fraudulent overage event insertion.

• CWE-269

• https://github.com/Cap-go/capgo/security/advisories/GHSA-qq85-vjrq-m75g
• https://www.vulncheck.com/advisories/capgo-privilege-escalation-via-security-definer-function-apply-usage-overage
• https://github.com/Cap-go/capgo/security/advisories/GHSA-qq85-vjrq-m75g

Published

Jun 21, 2026

Last Modified

Jun 24, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-56233Capgo before 12.128.2 contains a path traversal vulnerabilit…8.7
• CVE-2026-56234Capgo before 12.128.2 contains a credential validation vulne…6.9
• CVE-2026-56235Cap-go capgo before 12.128.2 contains an authorization bypas…6.9
• CVE-2026-56236Capgo CLI before 12.128.2 contains arbitrary file overwrite …6.8
• CVE-2026-56237Capgo before 12.128.2 contains a broken authentication vulne…9.3
• CVE-2026-56238Capgo before 12.128.2 contains an information disclosure vul…8.7
• CVE-2026-5624A security flaw has been discovered in ProjectSend r2002. Th…4.3
• CVE-2026-56240Capgo before 12.128.12 contains a billing authorization bypa…5.3
• CVE-2026-56241Capgo before 12.128.2 contains a privilege escalation vulner…8.3
• CVE-2026-56242Capgo before 12.128.2 contains an unauthenticated security d…8.7
• CVE-2026-56243Capgo before 12.128.2 contains a security control bypass vul…8.6
• CVE-2026-56244Capgo before 12.128.2 allows non-admin API keys to read webh…7.1