CVE-2026-56339

Capgo - Unauthenticated Organization Existence Enumeration via rescind_invitation RPC

State: Published
Severity: 8.7 High
Published: Jul 15, 2026
Updated: Jul 15, 2026
Reserved: Jun 20, 2026

Description

Capgo (Cap-go/capgo) before 12.128.2 contains an information disclosure vulnerability in the Supabase PostgREST SECURITY DEFINER RPC function public.rescind_invitation that allows unauthenticated attackers to enumerate organization existence. The function returns distinct error messages (NO_ORG vs NO_RIGHTS) when called with only a publishable API key, enabling attackers to discover valid organization IDs and increase the attack surface for targeted phishing or social engineering campaigns.

Scores

CVSS	Score	Vector	Source
4.0	8.7 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N	VulnCheck
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	VulnCheck

Weaknesses

CWE-203 Observable Discrepancy

Affected Products

Product	Versions
capgoCap-go	before 12.128.2Affected 12.128.2Not affected

References

GitHub Security Advisory (GHSA-8432-3cgm-vw5j)vendor-advisory
VulnCheck Advisory: Capgo - Unauthenticated Organization Existence Enumeration via rescind_invitation RPCthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.