Capgo before version 12.128.2 allows non‑admin API keys to read webhook signing secrets via the Supabase REST interface because the webhooks table does not enforce proper row‑level security policies. An attacker who obtains a non‑admin key can retrieve the secret and forge an X‑Capgo‑Signature header, then send authenticated events to any configured receiver. This defeats the authenticity and integrity guarantees of the webhook, enabling data tampering, fraud, or further access to protected resources. The weakness is a disclosure of sensitive information as defined by CWE‑200.

The vulnerability affects Capgo deployments running any version earlier than 12.128.2. System administrators should verify whether their Capgo instance is on a release prior to that version and identify any non‑admin API keys in use.

The CVSS score of 7.1 indicates a high impact when the conditions are met. Because EPSS is not available the likelihood of exploitation is uncertain, but the issue is not listed in the CISA KEV catalog, suggesting it is considered a moderate‑to‑high risk but not yet widely exploited. Attackers need only possess a non‑admin API key and access the public Supabase endpoint; therefore the attack vector is external via normal API calls.