CVE-2026-56248

Cap-go capgo (capgo-backend) before 12.128.12 contains an unauthenticated denial-of-service vulnerability arising from the audit_logs table's Row-Level Security (RLS) policy when accessed via the Supabase PostgREST API. Because the PostgreSQL query planner executes costly logic before RLS rejection, unfiltered queries to the public.audit_logs endpoint using the public anon key consistently trigger statement timeouts (PostgREST error 57014). Under concurrency, this exhausts database resources and causes cascading HTTP 500 failures on unrelated endpoints (e.g. /orgs), resulting in an application-layer denial of service.

• CWE-400

• https://github.com/Cap-go/capgo/security/advisories/GHSA-5vgv-rqj5-5748
• https://www.vulncheck.com/advisories/capgo-unauthenticated-denial-of-service-via-audit-logs-rls-policy
• https://github.com/Cap-go/capgo/security/advisories/GHSA-5vgv-rqj5-5748

Published

Jun 23, 2026

Last Modified

Jun 23, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-56242Capgo before 12.128.2 contains an unauthenticated security d…8.7
• CVE-2026-56243Capgo before 12.128.2 contains a security control bypass vul…8.6
• CVE-2026-56244Capgo before 12.128.2 allows non-admin API keys to read webh…7.1
• CVE-2026-56245Supabase Capgo before 12.128.2 contains an authorization byp…8.8
• CVE-2026-56246Capgo before 12.128.2 contains a broken access control vulne…8.1
• CVE-2026-56247Capgo before 12.128.2 allows org admins to assign org-scoped…8.8
• CVE-2026-56249Capgo before 12.128.2 contains an authorization bypass vulne…7.6
• CVE-2026-5625A weakness has been identified in assafelovic gpt-researcher…4.3
• CVE-2026-56250Capgo before 12.128.2 allows upload-scoped API keys to modif…8.7
• CVE-2026-56251Capgo before 12.128.2 contains a broken row level security p…7
• CVE-2026-56252Capgo before 12.128.2 contains a scope isolation vulnerabili…5.4
• CVE-2026-56253Capgo before 12.128.2 contains an improper access control vu…8.7