Capgo Information Disclosure Vulnerability in Supabase PostgREST RPC

An information disclosure vulnerability exists in Capgo versions prior to 12.128.2, specifically within the Supabase PostgREST RPC function public.get_total_metrics(org_id). This function can be accessed by the anon role using only the public sb_publishable_* key. Unauthenticated attackers can exploit this vulnerability to probe the existence of organizations and leak sensitive usage metrics such as monthly active users (MAU), bandwidth, and installation counts. The vulnerability is triggered by sending POST requests to /rest/v1/rpc/get_total_metrics with valid organization UUIDs.

Impact

Exploitation of this vulnerability allows for unauthorized access to sensitive organizational usage metrics and the ability to confirm the existence of specific organizations based on the response received.

Reproduction

To reproduce this vulnerability, send a POST request to the /rest/v1/rpc/get_total_metrics endpoint, using the public sb_publishable_* key for authorization. Include a valid organization UUID in the request. The response will contain sensitive usage metrics for the organization. In contrast, if an invalid UUID is used, the response will be an empty array, allowing for organization existence probing.

Remediation

To address this vulnerability, remove anonymous access to the public.get_total_metrics function and require authenticated membership checks. If the function must remain public, ensure it returns a constant response shape without exposing sensitive metrics.