Capgo’s backend before version 12.128.12 allows any unauthenticated user to invoke the audit_logs endpoint via Supabase PostgREST. The row‑level security policy for the audit_logs table triggers a costly PostgreSQL query planner operation before rejecting the request, which consistently causes statement timeouts. When multiple clients send such requests concurrently, database resources are exhausted and other endpoints experience cascading HTTP 500 failures, resulting in an application‑layer denial of service. The CVSS score of 8.7 reflects the severity of this disruption to service availability.

The affected product is Cap-go:capgo, specifically the capgo-backend component. All releases earlier than 12.128.12 are vulnerable; versions 12.128.12 and later have applied the fix. No other vendors or products are listed as affected.

This vulnerability is remotely exploitable by any party with access to the public anon key, which is typically publicly available in the default Supabase configuration. The lack of authentication requirement means an attacker can easily craft requests. Although the EPSS score is not published, the high CVSS rating, combined with the potential for resource exhaustion and cascading failures, indicates a high risk of exploitation. The vulnerability is not yet listed in CISA’s KEV catalog, but its impact on service availability warrants immediate attention.