Prior to version 12.128.2, Capgo exposes a PostgREST RPC endpoint, public.get_total_metrics, which is accessible to the anonymous role using the public sb_publishable_* key. By sending a POST request to /rest/v1/rpc/get_total_metrics with a valid organization UUID, an attacker without any authentication can retrieve sensitive business metrics, such as monthly active user counts, bandwidth consumption and install totals. The disclosed data can reveal usage patterns and operational insights, constituting an information exposure flaw (CWE‑200).

All Capgo instances running a version earlier than 12.128.2 that have not removed the default public get_total_metrics RPC from the public schema are vulnerable. Any deployment that uses the standard public sb_publishable_* key and allows the anon role to query the endpoint remains at risk.

With a CVSS score of 6.9, the vulnerability is rated moderate severity. The EPSS score is below 1 %, indicating a low probability of exploitation, and the issue is not listed in CISA’s KEV catalog. Attackers can exploit the flaw remotely by issuing a simple HTTP POST request; no privileged credentials or additional setup are required. Because the RPC accepts any organization UUID, attackers can enumerate valid organization identifiers and harvest proprietary usage statistics from an exposed set of customer accounts.