CVE-2026-56235 describes an authorization bypass in Cap-go capgo prior to version 12.128.2 affecting Supabase PostgREST RPC functions get_app_metrics, get_global_metrics, and get_total_metrics. These functions are granted to the anon role and do not enforce org membership or permission checks, allowing unauthenticated attackers using the public Supabase API key (sb_publishable_*) to query arbitrary org_id values. This leads to unauthorized disclosure of cross-tenant usage telemetry data such as monthly active users, bandwidth, installs, and gets. Attackers can also enumerate app IDs for target organizations and determine organization existence based on response differences.

The vulnerability allows unauthenticated attackers to bypass authorization controls and access sensitive usage telemetry data across different tenants. This includes metrics like monthly active users, bandwidth consumption, installs, and API gets. Additionally, attackers can enumerate application IDs and confirm the existence of organizations, potentially aiding further targeted attacks or information gathering. There is no indication of data modification or service disruption from this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected RPC functions or enforce org membership and permission checks on these endpoints. Monitor for updates from the vendor regarding patches or official mitigations.