EUVD-2026-44623
GHSA-q5cf-73cv-r7f2
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network-reachable RPC with low complexity (PR:N/AV:N/AC:L), but it leaks only organization existence, so confidentiality is Low and integrity/availability are None.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
Capgo (Cap-go/capgo) before 12.128.2 contains an information disclosure vulnerability in the Supabase PostgREST SECURITY DEFINER RPC function public.rescind_invitation that allows unauthenticated attackers to enumerate organization existence. The function returns distinct error messages (NO_ORG vs NO_RIGHTS) when called with only a publishable API key, enabling attackers to discover valid organization IDs and increase the attack surface for targeted phishing or social engineering campaigns.
AnalysisAI
Unauthenticated organization enumeration in Capgo before 12.128.2 lets attackers abuse the Supabase PostgREST SECURITY DEFINER RPC public.rescind_invitation, which returns distinguishable NO_ORG versus NO_RIGHTS errors when invoked with only a publishable (anon) API key. This oracle lets remote unauthenticated attackers confirm which organization IDs exist, building a target list for follow-on phishing and social engineering. Reported by VulnCheck; no public exploit code and no CISA KEV listing at time of analysis.
Technical ContextAI
Capgo is a live/over-the-air update service for Capacitor mobile apps that uses Supabase (PostgreSQL + PostgREST) as its backend. The flaw sits in a PostgreSQL function marked SECURITY DEFINER, meaning it executes with the privileges of the function owner rather than the caller, so it can read data the anonymous role normally cannot. Because rescind_invitation branches its error path - emitting NO_ORG when the organization does not exist and NO_RIGHTS when it exists but the caller lacks permission - the differing responses form a classic observable-discrepancy oracle (CWE-203), leaking existence state through side-channel error messages rather than through an intended data field.
RemediationAI
Vendor-released patch: upgrade Capgo to 12.128.2 or later, which corrects the rescind_invitation function's error handling. Operators running self-hosted Capgo/Supabase instances should apply the corresponding database migration so the RPC returns a uniform, non-distinguishing error (or rejects anonymous callers) regardless of whether the organization exists, eliminating the NO_ORG versus NO_RIGHTS discrepancy. As interim compensating controls before patching, restrict or revoke anonymous access to the rescind_invitation RPC at the PostgREST/Row-Level-Security layer, or rate-limit and monitor calls from the publishable anon key to detect enumeration sweeps - trade-off is that tightening RLS on the anon role may break legitimate invitation flows and should be tested. Consult GHSA-8432-3cgm-vw5j (https://github.com/Cap-go/capgo/security/advisories/GHSA-8432-3cgm-vw5j) and the VulnCheck advisory for specifics.
Account pre-registration hijack in Capgo before 12.128.2 lets a remote unauthenticated attacker claim an account under a
Authentication bypass in Capgo prior to version 12.128.2 lets attackers defeat email-based OTP verification by tampering
Cross-tenant data poisoning in Supabase Capgo before 12.128.2 allows remote unauthenticated attackers to corrupt billing
Unauthenticated denial of service in Cap-go capgo (capgo-backend) before 12.128.12 allows remote attackers to exhaust Po
Cross-tenant billing log tampering in Capgo (Cap-go/capgo) before 12.128.2 allows unauthenticated attackers holding only
Account takeover in Cap-go (Capgo) versions prior to 12.128.2 allows an attacker holding a temporary authenticated sessi
SQL injection in Capgo (cap-go) before 12.128.2 allows authenticated users with read-level API keys to access analytics
Privilege inversion in Cap-go (Capgo) before 12.128.2 lets holders of read-only API keys cancel running native builds by
Denial of service in Capgo Console versions prior to 12.28.2 allows an authenticated attacker to lock legitimate users o
Capgo's Enforce Password Policy feature in versions before 12.128.2 permanently locks Super Admins out of their organiza
Cross-tenant information disclosure in Capgo (cap-go/capgo) before version 12.128.2 exposes per-organization usage telem
Unauthenticated job ID enumeration in Cap-go (Capgo) before version 12.128.2 exposes internal builder job identifiers vi
Same weakness CWE-203 – Observable Discrepancy
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today