Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2026-56339

Capgo - Unauthenticated Organization Existence Enumeration via rescind_invitation RPC

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

Capgo (Cap-go/capgo) before 12.128.2 contains an information disclosure vulnerability in the Supabase PostgREST SECURITY DEFINER RPC function public.rescind_invitation that allows unauthenticated attackers to enumerate organization existence. The function returns distinct error messages (NO_ORG vs NO_RIGHTS) when called with only a publishable API key, enabling attackers to discover valid organization IDs and increase the attack surface for targeted phishing or social engineering campaigns.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Cap-go capgo

Default version status: unaffected

  • 0 to < 12.128.2affected
  • 12.128.2unaffected

References