Description (CNA)
Cap-go capgo (capgo-backend) before 12.128.12 contains an unauthenticated denial-of-service vulnerability arising from the audit_logs table's Row-Level Security (RLS) policy when accessed via the Supabase PostgREST API. Because the PostgreSQL query planner executes costly logic before RLS rejection, unfiltered queries to the public.audit_logs endpoint using the public anon key consistently trigger statement timeouts (PostgREST error 57014). Under concurrency, this exhausts database resources and causes cascading HTTP 500 failures on unrelated endpoints (e.g. /orgs), resulting in an application-layer denial of service.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Cap-go / capgo | affected 0 before 12.128.12; unaffected 12.128.12 |
CWE
CWE-400
References
- https://github.com/Cap-go/capgo/security/advisories/GHSA-5vgv-rqj5-5748
- https://www.vulncheck.com/advisories/capgo-unauthenticated-denial-of-service-via-audit-logs-rls-policy
ADP enrichment
No English description supplied.