Capgo versions before 12.128.2 have an information disclosure vulnerability in the Supabase PostgREST global_stats endpoint. This flaw allows unauthenticated attackers to access sensitive financial and operational metrics by using only the public API key. Attackers can query the /rest/v1/global_stats endpoint to retrieve data such as monthly recurring revenue (MRR), total revenue, plan-tier revenue breakdown, customer counts, and operational telemetry.