Technical impact
A function exposed via PostgREST RPC, specifically public.upsert_version_meta, bypasses authentication in Capgo releases prior to 12.128.2. The function allows an unauthenticated attacker to insert arbitrary rows into the version_meta table for any app_id. This results in persistent false data appearing in storage metrics dashboards and can trigger incorrect alerts across victim applications.
Affected Systems
Any Capgo instance running a version older than 12.128.2. The vulnerability is independent of application configuration because the vulnerable RPC is exposed publicly and can be accessed with the default anonymous key.
Risk and Exploitability
The CVSS score of 6.9 indicates a moderate risk, and the exploitability is high because the RPC endpoint is publicly reachable and requires no authentication. Attackers need only send a single request to the upsert_version_meta RPC with an anonymous key, which is typically available on any public installation. The vulnerability is not listed in CISA KEV and no EPSS score is available, but the straightforward exploitation path and potential for disruptive false metrics make it a priority to remediate.
