EUVD-2026-42881
GHSA-f8rq-8r29-248p
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network RPC with trivial invocation gives AV:N/AC:L/PR:N/UI:N; read-only cross-tenant data leak yields C:H with I:N/A:N and no scope change.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Capgo before 12.128.2 contains an information disclosure vulnerability in the get_orgs_v7(userid) RPC function that remains publicly invokable despite intended private access controls. Unauthenticated attackers can supply arbitrary user UUIDs to retrieve foreign users' organization membership, roles, management emails, and billing metadata.
AnalysisAI
Information disclosure in Capgo before 12.128.2 lets unauthenticated remote attackers call the get_orgs_v7(userid) RPC endpoint with arbitrary user UUIDs to read foreign users' organization memberships, roles, management emails, and billing metadata. The endpoint remained publicly invokable despite intended private access controls, so any internet-facing Capgo deployment on an affected version exposes tenant data cross-account. No public exploit has been identified at time of analysis, though the trivial invocation pattern (supply a UUID) makes weaponization straightforward.
Technical ContextAI
Capgo is a live/over-the-air (OTA) update platform for Capacitor mobile apps, whose backend is built on Supabase/PostgREST, where server-side logic is exposed as PostgreSQL RPC functions callable over HTTPS. The get_orgs_v7 function is one such RPC; the affected CPE cpe:2.3:a:capgo:capgo:*:*:*:*:*:*:*:* covers all versions prior to 12.128.2. The root cause is CWE-862 (Missing Authorization): the function accepts a caller-supplied userid parameter and returns that user's organization data without verifying that the requesting session is authorized to act as, or view data for, that user. In Supabase terms this typically stems from a SECURITY DEFINER function or an RPC granted to the anon role without an internal check binding the query to auth.uid(), allowing the client-controlled UUID to override the intended identity boundary.
RemediationAI
Vendor-released patch: upgrade Capgo to 12.128.2 or later, which restores the intended access controls on the get_orgs_v7 RPC (see GitHub Security Advisory GHSA-fch8-pp28-mw2x). Self-hosted operators who cannot immediately upgrade should apply a compensating control at the database layer: revoke EXECUTE on the get_orgs_v7 function from the anon (and, if appropriate, authenticated) Supabase role, or wrap the function body to enforce that the supplied userid matches auth.uid() before returning rows - with the trade-off that any legitimate client code depending on cross-user lookups will break until refactored. As an interim network control, front the PostgREST RPC path with an API gateway or WAF rule blocking unauthenticated calls to /rest/v1/rpc/get_orgs_v7, accepting that this is coarse and may also block valid authenticated use. Because the exposure is confidentiality-only, treat already-leaked data (management emails, billing metadata) as potentially compromised and consider notification obligations. Advisory details: https://github.com/Cap-go/capgo/security/advisories/GHSA-fch8-pp28-mw2x and https://www.vulncheck.com/advisories/capgo-information-disclosure-via-get-orgs-v7-rpc-endpoint .
Authentication bypass in Capgo before 12.128.2 lets remote unauthenticated attackers mint arbitrary API keys by tamperin
Cross-domain SSO account takeover in Capgo before 12.128.2 allows an attacker with enterprise org admin access and a mal
Account pre-registration hijack in Capgo before 12.128.2 lets a remote unauthenticated attacker claim an account under a
Authentication bypass in Capgo prior to version 12.128.2 lets attackers defeat email-based OTP verification by tampering
Rate-limit bypass in Capgo versions prior to 12.128.2 lets remote unauthenticated attackers flood the channel_self endpo
Cross-tenant data poisoning in Supabase Capgo before 12.128.2 allows remote unauthenticated attackers to corrupt billing
Server-side privilege escalation in Capgo before 12.128.2 lets authenticated users holding build permissions abuse a pat
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers query the /functions/v1/channel_se
Account takeover in Capgo before 12.128.2 stems from a password-change endpoint that omits current-password validation (
Information disclosure in Capgo (Capacitor live-update/OTA platform) before 12.128.2 lets unauthenticated callers abuse
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers read organization RBAC role bindin
Cross-tenant authorization bypass in Capgo before 12.128.2 lets authenticated users impersonate another tenant's limited
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today