CVE-2026-56235 describes an authorization bypass in Cap-go capgo before version 12.128.2. The vulnerability affects multiple Supabase PostgREST RPC functions that are exposed to the anon role without enforcing organization membership or permission validation. An attacker can use the public Supabase API key to query arbitrary org_id values, disclosing sensitive cross-tenant telemetry data such as monthly active users, bandwidth, installs, and gets. Additionally, the attacker can enumerate app IDs for a target organization and determine whether an organization exists based on the response pattern of these RPC calls.

The vulnerability allows unauthorized disclosure of sensitive telemetry data across tenants, including usage metrics and app identifiers. This exposure can lead to privacy violations and information leakage about organizations using the service. However, it does not require authentication or elevated privileges beyond the public API key. There is no indication of direct data modification or service disruption from this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected RPC functions or enforce additional permission checks at the application or API gateway level to prevent unauthorized access. Monitor vendor communications for updates regarding a patch or official remediation.