Capgo CVE-2026-56327

The attacker must possess a publishable API key from any application built on the target Capgo instance; such keys are intentionally distributed in mobile app binaries and are not secret. The public.invite_user_to_org RPC endpoint must be network-accessible, which is the default deployment posture for Capgo. No authentication, user interaction, or privileged position is required beyond possession of the publishable key. Exploitation is bounded in impact: only organization ID existence is disclosed - no credentials, user data, or content are exposed. Effective exploitation is further limited if the Capgo instance implements aggressive API rate-limiting or anomaly detection on RPC calls, though neither is confirmed as a default control from available data.

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N scores 6.9 and accurately characterizes this as network-accessible, zero-complexity, effectively unauthenticated exploitation with low confidentiality impact - no inflation or deflation detected. No EPSS data was provided in the input, so probabilistic exploitation likelihood cannot be quantified. The vulnerability is not listed in CISA KEV and no POC has been confirmed, suggesting no widespread active exploitation at time of analysis. Despite the modest impact ceiling, the real-world risk warrants prompt patching: the attack is fully automatable (no interaction required, no rate-limiting implied by default configuration), the key material is publicly distributed, and tenant enumeration is a recognized reconnaissance primitive enabling downstream attacks such as spear-phishing and credential stuffing against confirmed organizations. For deployments where customer identity confidentiality is a compliance requirement, the practical severity is higher than the raw CVSS score implies.

An attacker extracts a publishable API key from any publicly distributed mobile application built on Capgo - no reverse engineering is required as such keys are designed to be client-visible. The attacker then runs an automated script iterating over candidate organization IDs, calling public.invite_user_to_org for each and classifying responses as NO_ORG (does not exist) or NO_RIGHTS (exists), building a confirmed list of active tenant IDs for use in targeted downstream attacks such as phishing or credential stuffing. No public POC has been confirmed, but the attack requires only standard HTTP tooling.