NVD HIGH: CVE-2026-56245 — Supabase Capgo before 12.128.2 contains an authorization bypass vulnerability in...

Wednesday, June 24, 2026 at 01:16 PM UTC·Source: NIST NVD

Updated: Wednesday, June 24, 2026 at 04:00 PM UTC

Executive Summary

Supabase Capgo before 12.128.2 contains an authorization bypass vulnerability in the SECURITY DEFINER record_build_time RPC function that allows unauthenticated attackers to insert arbitrary build-time records. Attackers can exploit this by calling POST /rest/v1/rpc/record_build_time with a public API key to poison billing and quota data for any organization, enabling resource exhaustion and cross

Analysis

Indicators of Compromise (1)

CVE (1)

CVE-2026-56245

NVD MITRE CVE

Source Attribution

Originally published by NIST NVD on Jun 24, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

Credit Agricole launches euro stablecoin

French bank Credit Agricole has launched a euro-denominated stablecoin and subscribed to a tokenised Amundi money market fund (MMF), in what the bank has described as a European first.

19m agoFinextra

MEDIUMVulnerabilityNEW

Pay.UK launches liquidity model for faster payments

Pay.UK, the recognised operator and standards body for the UK’s interbank retail payment systems, has gone live with a flexible model for liquidity requirements for Faster Payments Net Sender Caps (NSC), further facilitating access for a wider range of participants.

23m agoFinextra

MEDIUMVulnerabilityNEW

Unzer appoints chief product and AI officer

Unzer, a leading European provider of payment and software solutions, has appointed Isabelle Bénard as Chief Product & AI Officer (CPAIO).

33m agoFinextra