The vulnerability in Capgo (Cap-go/capgo) prior to 12.128.2 involves improper access control in the SECURITY DEFINER PostgREST RPC function public.record_build_time. This function is granted to the anon role and can be invoked using only the public Supabase publishable anon key (sb_publishable_*). An unauthenticated attacker can exploit this to insert rows into the public.build_logs table for arbitrary organizations. Due to the function's use of ON CONFLICT (build_id, org_id) DO UPDATE, attackers can overwrite existing usage and billing records by reusing the same build_id for a targeted organization. This leads to cross-tenant tampering of billing data and can cause financial-impact denial of service by inflating billable build time.

An unauthenticated attacker can manipulate billing and usage records across tenants by inserting or overwriting entries in the build_logs table. This can result in incorrect billing data, financial impact due to inflated billable build time, and denial of service conditions related to billing integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the public.record_build_time function and the anon role permissions to prevent unauthenticated invocation. Monitor for unusual activity related to build_logs entries. Avoid using the public Supabase publishable anon key for sensitive operations.