CVE-2026-56248

High

Description

Cap-go capgo (capgo-backend) before 12.128.12 contains an unauthenticated denial-of-service vulnerability arising from the audit_logs table's Row-Level Security (RLS) policy when accessed via the Supabase PostgREST API. Because the PostgreSQL query planner executes costly logic before RLS rejection, unfiltered queries to the public.audit_logs endpoint using the public anon key consistently trigger statement timeouts (PostgREST error 57014). Under concurrency, this exhausts database resources and causes cascading HTTP 500 failures on unrelated endpoints (e.g. /orgs), resulting in an application-layer denial of service.

SeverityHigh

CVSS7.5

Exploit probability—

ProductCap-go Capgo

PublishedJun 23, 2026

First seenJun 23, 2026

Weakness typeCWE-400Uncontrolled resource consumption

How to fix

Update

Cap-go capgo12.128.12 or later

Vendor advisories

github.com/Cap-go/capgo/security/advisories/GHSA-5vgv-rqj5-5748

Affected products

Product	Affected versions	Fixed in
Cap-go capgo	v < 12.128.12	12.128.12

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.