CyberRota Analysis
AI-GeneratedAn information disclosure vulnerability in Capgo versions prior to 12.128.2 allows unauthenticated attackers to access sensitive financial and operational metrics via the Supabase PostgREST global_stats endpoint using only the public API key. This could lead to the exposure of critical data such as monthly recurring revenue, total revenue, and customer counts. Organizations utilizing Capgo should prioritize patching to mitigate the risk of unauthorized data exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Capgo before 12.128.2 contains an information disclosure vulnerability in the Supabase PostgREST global_stats endpoint that allows unauthenticated attackers to read sensitive financial and operational metrics using only the public apikey. Remote attackers can query the /rest/v1/global_stats endpoint to expose MRR, total revenue, plan-tier revenue breakdown, customer counts, and operational telemetry.