Supabase Capgo implementations prior to version 12.128.2 expose a security-definer RPC function, record_build_time, which can be called with a public API key. This permits an unauthenticated attacker to insert arbitrary build-time records. The injected records corrupt billing and quota data for any organization, effectively siphoning resources and manipulating cross‑tenant accounting. The underlying weakness is a privilege‑escalation flaw (CWE‑269) that allows code authored with elevated rights to be executed by an unauthenticated caller.

The vulnerability affects Cap‑go Capgo deployments running any release before 12.128.2. Only versions earlier than 12.128.2 are susceptible; later releases have patched the RPC function to enforce proper authorization.

With a CVSS score of 8.8, this issue is classified as high severity. The EPSS score is not available, and the vulnerability has not been listed in the CISA KEV catalog, indicating no known active exploits at the time of this analysis. Attackers can exploit the flaw by issuing a POST request to /rest/v1/rpc/record_build_time using a public API key, thereby bypassing authentication and inserting malicious accounting records across tenant boundaries.