Capgo versions prior to 12.128.2 contain an information disclosure flaw in the Supabase PostgREST RPC endpoints is_trial_org and is_paying_org. The endpoints are reachable with the public sb_publishable key and return distinct responses that reveal whether a particular organization exists and whether it is a paying customer. An unauthenticated attacker can simply send HTTP requests to these endpoints and learn sensitive billing status, which can be used for profiling or other malicious purposes.

Any Capgo deployment running a version earlier than 12.128.2 that exposes the is_trial_org and is_paying_org RPC endpoints is affected. The vulnerability applies to all installations that allow unsupervised access to these endpoints through the public sb_publishable key.

The CVSS score of 8.7 classifies this as a high‑severity vulnerability. Although no EPSS score is available and the issue is not listed in the CISA KEV catalog, the lack of authentication makes the exploit low effort. An attacker only needs the publicly provided key and does not require credentials; responding states differ between existing and non‑existing organizations, allowing enumeration. The risk is that an attacker can compile a list of paying customers and gain insight into the billing structure of the organization.