Capgo before version 12.128.2 contains an authorization bypass in the public.get_current_plan_max_org RPC. This flaw allows attackers who are not authenticated to query any organization UUID with only the public Supabase key, thereby exposing plan limits such as monthly active users, bandwidth, storage, and build time. The primary impact is the disclosure of confidential billing and usage data, which could assist adversaries in reconstructing organizational size or planning further attacks.

The vulnerability affects installations of Capgo using the Capgo:Capgo product. Any instance running a version earlier than 12.128.2 is susceptible. No specific operating system or deployment environment is listed, so all configurations running the affected Capgo instance are at risk.

The CVSS score of 6.9 indicates moderate severity; the ecosystem risk is amplified because attackers only need the public Supabase key, which is widely distributed. The EPSS data is unavailable, but the failure mode does not require code execution or privileged access, only unauthenticated read access. Because the KEV catalog does not list this vulnerability, there is no evidence of widespread exploitation yet, but the ability to retrieve billing information could be exploited for targeted phishing or social engineering. The attack vector is external via the public RPC endpoint.