CVE-2026-56284 describes an information disclosure vulnerability in Capgo (Cap-go/capgo) versions prior to 12.128.2. The vulnerability exists in the Supabase PostgREST RPC function public.get_total_metrics(org_id), which is accessible to the anon role with only the public sb_publishable_* key. An unauthenticated attacker can exploit this to confirm the existence of organizations and retrieve sensitive usage metrics including monthly active users, bandwidth consumption, and install counts by sending crafted POST requests to the /rest/v1/rpc/get_total_metrics endpoint with valid organization UUIDs. The CVSS 4.0 base score is 6.9, indicating a medium severity vulnerability. There is no vendor advisory or patch information available, and no known exploits in the wild have been reported.

An unauthenticated attacker can obtain sensitive organizational usage data such as monthly active users, bandwidth usage, and install counts. This exposure could lead to privacy concerns and potential competitive intelligence gathering. However, the vulnerability does not allow for privilege escalation, code execution, or direct system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the public sb_publishable_* key and the public.get_total_metrics RPC function if possible. Monitor for unusual POST requests to /rest/v1/rpc/get_total_metrics and consider implementing additional access controls or rate limiting to reduce exposure.