EUVD-2026-40438
GHSA-443m-f58x-jx9j
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Publishable key is publicly distributed so effectively PR:N; only org existence leaks so C:L; no integrity or availability impact applies.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Capgo before 12.128.2 contains an information disclosure vulnerability in the public.invite_user_to_org RPC function that allows unauthenticated attackers to enumerate organization existence by observing distinct error responses. Attackers can call the SECURITY DEFINER function with a publishable API key to determine if an organization ID exists based on NO_ORG versus NO_RIGHTS responses, enabling tenant enumeration attacks.
AnalysisAI
Unauthenticated organization enumeration in Capgo before 12.128.2 exposes tenant existence through differential error responses in the public.invite_user_to_org SECURITY DEFINER RPC function. Any caller holding a publishable API key - a client-side credential intentionally distributed in mobile apps - can probe arbitrary organization IDs and distinguish NO_ORG from NO_RIGHTS responses, confirming or denying tenant existence at scale. No active exploitation is confirmed (not in CISA KEV) and no public POC has been identified, but the attack barrier is exceptionally low given the freely obtainable key material and the network-accessible default posture.
Technical ContextAI
Capgo is a self-hostable live update platform for Capacitor mobile apps, built on a Supabase/PostgreSQL backend. The vulnerable function public.invite_user_to_org is a PostgreSQL SECURITY DEFINER procedure, meaning it runs with elevated database-owner privileges regardless of the caller's actual role - a design pattern intended to allow controlled privilege escalation. The root cause is CWE-203 (Observable Discrepancy): the function returns semantically distinct error codes (NO_ORG when the organization does not exist versus NO_RIGHTS when it does exist but the caller lacks permission), creating an information oracle. A publishable API key is a non-secret client credential embedded in app binaries for legitimate SDK use; its exposure to end users is by design, making it effectively unauthenticated from a trust-boundary perspective. CPE cpe:2.3:a:capgo:capgo:*:*:*:*:*:*:*:* covers all Capgo versions prior to 12.128.2.
RemediationAI
Upgrade Capgo to version 12.128.2 or later as the primary remediation; this is the vendor-confirmed fix per the GitHub Security Advisory GHSA-35q8-ghfg-vp6m at https://github.com/Cap-go/capgo/security/advisories/GHSA-35q8-ghfg-vp6m. The fix is expected to normalize the error responses from public.invite_user_to_org so that both the organization-not-found and permission-denied paths return an indistinguishable response, eliminating the oracle. If immediate upgrade is not feasible, apply rate-limiting and anomaly detection at the API gateway or reverse proxy layer targeting calls to the invite_user_to_org RPC endpoint - this raises the cost of automated enumeration but does not eliminate the underlying discrepancy. As a more aggressive compensating control, block external access to this specific RPC endpoint entirely if the invite workflow is not relied upon externally; this eliminates the attack surface with the trade-off of disabling the invite feature for unauthenticated callers.
Authentication bypass in Capgo before 12.128.2 lets remote unauthenticated attackers mint arbitrary API keys by tamperin
Cross-domain SSO account takeover in Capgo before 12.128.2 allows an attacker with enterprise org admin access and a mal
Account pre-registration hijack in Capgo before 12.128.2 lets a remote unauthenticated attacker claim an account under a
Authentication bypass in Capgo prior to version 12.128.2 lets attackers defeat email-based OTP verification by tampering
Rate-limit bypass in Capgo versions prior to 12.128.2 lets remote unauthenticated attackers flood the channel_self endpo
Cross-tenant data poisoning in Supabase Capgo before 12.128.2 allows remote unauthenticated attackers to corrupt billing
Server-side privilege escalation in Capgo before 12.128.2 lets authenticated users holding build permissions abuse a pat
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers query the /functions/v1/channel_se
Account takeover in Capgo before 12.128.2 stems from a password-change endpoint that omits current-password validation (
Information disclosure in Capgo (Capacitor live-update/OTA platform) before 12.128.2 lets unauthenticated callers abuse
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers read organization RBAC role bindin
Cross-tenant authorization bypass in Capgo before 12.128.2 lets authenticated users impersonate another tenant's limited
Same weakness CWE-203 – Observable Discrepancy
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today