EUVD-2026-38169
GHSA-hch8-5p6h-pqxh
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Reachable over the internet with only a publishable client key and an org UUID (AV:N/AC:L/PR:N/UI:N); discloses member PII but does not modify state or affect availability, so C:H/I:N/A:N.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Capgo before 12.128.2 contains an improper access control vulnerability in the public.get_org_members RPC function that allows unauthenticated attackers to enumerate organization members. Attackers can invoke the endpoint using only the public sb_publishable_* key and an organization UUID to retrieve sensitive member information including email addresses, user IDs, roles, and pending invitations.
AnalysisAI
Unauthenticated organization member enumeration in Capgo before 12.128.2 allows remote attackers to harvest email addresses, user IDs, roles, and pending invitations by invoking the public.get_org_members RPC with only a publishable Supabase key and a target organization UUID. The flaw, reported by VulnCheck and tracked as EUVD-2026-38169, carries a CVSS 4.0 score of 8.7 and reflects a broken access control check on a public Postgres RPC. No public exploit identified at time of analysis, but the trivial invocation makes mass scraping straightforward once an org UUID is known.
Technical ContextAI
Capgo is an open-source live-update and OTA delivery platform for Capacitor mobile apps, backed by Supabase (PostgREST + Postgres). The vulnerable surface is a Postgres RPC named public.get_org_members exposed through the Supabase REST gateway and reachable using the client-side anon/publishable key (sb_publishable_*), which is normally embedded in mobile or web bundles by design. CWE-284 (Improper Access Control) applies because the function lacks an authorization check tying the caller's authenticated identity to the requested organization UUID; instead it returns member metadata to any caller presenting the publishable key, effectively treating an anonymous client as authorized. CPE coverage is cpe:2.3:a:capgo:capgo:*:*:*:*:*:*:*:* with all versions prior to 12.128.2 affected.
RemediationAI
Patch available per vendor advisory: upgrade Capgo to 12.128.2 or later as published in GHSA-x34h-gc65-f6g4 (https://github.com/Cap-go/capgo/security/advisories/GHSA-x34h-gc65-f6g4), which adds the missing authorization check to public.get_org_members. If immediate upgrade is not possible, temporarily revoke EXECUTE on public.get_org_members from the anon (and authenticated, if appropriate) Postgres role so the RPC is no longer reachable via the publishable key, accepting that any UI flow relying on this RPC will break until patched; alternatively, wrap the RPC body with an explicit auth.uid()/organization-membership check or front the Supabase endpoint with a WAF rule that blocks POST /rest/v1/rpc/get_org_members from clients without a valid user JWT. After patching, rotate publishable keys only if you suspect prior abuse - rotation does not retroactively protect already-enumerated data, so also notify affected organization members if disclosure logs indicate scraping.
Authentication bypass in Capgo before 12.128.2 lets remote unauthenticated attackers mint arbitrary API keys by tamperin
Cross-domain SSO account takeover in Capgo before 12.128.2 allows an attacker with enterprise org admin access and a mal
Account pre-registration hijack in Capgo before 12.128.2 lets a remote unauthenticated attacker claim an account under a
Authentication bypass in Capgo prior to version 12.128.2 lets attackers defeat email-based OTP verification by tampering
Rate-limit bypass in Capgo versions prior to 12.128.2 lets remote unauthenticated attackers flood the channel_self endpo
Cross-tenant data poisoning in Supabase Capgo before 12.128.2 allows remote unauthenticated attackers to corrupt billing
Server-side privilege escalation in Capgo before 12.128.2 lets authenticated users holding build permissions abuse a pat
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers query the /functions/v1/channel_se
Account takeover in Capgo before 12.128.2 stems from a password-change endpoint that omits current-password validation (
Information disclosure in Capgo (Capacitor live-update/OTA platform) before 12.128.2 lets unauthenticated callers abuse
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers read organization RBAC role bindin
Cross-tenant authorization bypass in Capgo before 12.128.2 lets authenticated users impersonate another tenant's limited
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today