CVE-2026-56245 is an authorization bypass vulnerability in Supabase Capgo's SECURITY DEFINER record_build_time RPC function affecting versions prior to 12.128.2. The vulnerability permits unauthenticated attackers to invoke the record_build_time RPC via a public API key to insert arbitrary build-time records. This can corrupt billing and quota data for any organization, potentially causing resource exhaustion and manipulation of billing across tenants. The CVSS 4.0 score is 8.8, reflecting high severity with network attack vector, no privileges or user interaction required, but high impact on integrity and low impact on availability and confidentiality.

Successful exploitation allows unauthenticated attackers to bypass authorization controls and insert arbitrary build-time records, leading to poisoning of billing and quota data. This can cause resource exhaustion and enable attackers to manipulate billing across different tenants, potentially resulting in financial and operational impacts for affected organizations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented at this time. Until a patch is available, restrict access to the affected RPC endpoint if possible and monitor for unusual activity related to billing and quota data manipulation.