Capgo EUVD-2026-42881

The prerequisite is a network-reachable Capgo instance (version before 12.128.2) exposing the get_orgs_v7 Postgres RPC endpoint to unauthenticated callers, which the advisory describes as the default flawed state. The concrete exploitation requirement is possession of a valid target user UUID to pass as the userid argument - the attacker must obtain or guess these UUIDs, which is the main limiting factor since UUIDs are random rather than sequentially enumerable. Beyond that there are no limiting conditions: no authentication (PR:N), no user interaction (UI:N), and no non-default configuration is needed. Exploitation is read-only, so it discloses data but cannot modify or disrupt the service.

This is a genuine priority for any exposed Capgo instance rather than an inflated high-CVSS finding. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) is internally consistent with the description: network-reachable, low complexity, no authentication, no user interaction, high confidentiality impact and no integrity/availability impact - matching a read-only IDOR-style data leak. Exploitation requires only that the attacker obtain victim user UUIDs, which lowers practical friction, though UUIDs are random rather than sequentially enumerable and may need to be sourced elsewhere, a mild limiting factor. No EPSS score, KEV listing, or POC was provided, so there is no evidence of active exploitation; the risk is driven by ease of exploitation and data sensitivity (billing metadata, management emails) rather than by confirmed in-the-wild activity. The confidentiality-only impact means no code execution or data tampering, so treat this as a data-exposure/privacy incident risk, not a system-compromise risk.

An unauthenticated attacker sends an HTTPS RPC call to a Capgo backend invoking get_orgs_v7 with a target user's UUID (harvested from public profiles, prior data, or another leak) and receives that user's organization memberships, roles, management emails, and billing metadata. Repeating this across many UUIDs allows bulk harvesting of cross-tenant account and billing information. No authentication, user interaction, or special tooling beyond a standard HTTP client is required.