CVE-2026-56082 describes an improper access control vulnerability in Capgo's public.record_build_time PostgREST RPC function, which is defined with SECURITY DEFINER privileges and granted to the anon role. Because this function is callable with only the public Supabase publishable anon key, an unauthenticated attacker can insert rows into the public.build_logs table for arbitrary organizations. The function uses an ON CONFLICT clause on (build_id, org_id) to perform updates, enabling attackers to overwrite existing usage and billing records by reusing build_id values for targeted organizations. This results in cross-tenant tampering of billing data and can cause financial-impact denial of service by inflating billable build time. The vulnerability affects Capgo versions prior to 12.128.2. No official patch or remediation guidance has been provided yet.

An unauthenticated attacker can manipulate billing and usage records across tenants by inserting or overwriting build logs for arbitrary organizations. This can lead to financial-impact denial of service through inflated billable build time and cross-tenant data tampering, potentially affecting billing accuracy and trustworthiness.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the public.record_build_time RPC function or the anon role permissions to prevent unauthorized invocation. Monitor for unusual billing records or build log entries that could indicate exploitation attempts.