EUVD-2026-44623
GHSA-q5cf-73cv-r7f2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessExtract publishable anon key from client app
-
DeliveryCall rescind_invitation RPC with candidate org IDs
-
ExploitCompare NO_ORG vs NO_RIGHTS responses
-
ExecutionEnumerate valid organization IDs
-
ImpactLaunch targeted phishing against confirmed orgs
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V6 - Authentication Timing-safe comparisons
|
| Exploitation Conditions | Exploitation requires that the Capgo/Supabase backend expose the SECURITY DEFINER RPC public.rescind_invitation to the anonymous role, and that the attacker possess the publishable (anon) API key - which is by design embedded in and extractable from the distributed client app, so it is effectively public rather than a real barrier. Per CVSS PR:N the attack is unauthenticated with no user interaction and network-reachable. The main limiting factor is impact scope: the attacker only learns whether an organization ID exists (a valid-vs-invalid oracle), not its data; enumeration also depends on being able to iterate candidate org IDs, and the issue is fixed in 12.128.2 so only pre-patch deployments are affected. |
| Impact | The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) yields 8.7, but the VC:H (high confidentiality) rating appears inflated for what is fundamentally existence enumeration: the function leaks whether an org ID is valid, not its contents, credentials, or PII, so real-world confidentiality impact is closer to Low. No EPSS score, KEV entry, or POC was provided; treat this as no public exploit identified at time of analysis. The genuine risk is reconnaissance value - it removes anonymity of org IDs and enables targeted phishing - rather than direct compromise. Signals are consistent (unauthenticated, low complexity, network-reachable) so exploitation is trivial, but the impact ceiling is modest; prioritize as a patch-in-normal-cycle information-disclosure issue, not an emergency, with the caveat that the scored VC:H overstates severity versus the description. |
| Exploit ScenarioDerived | An attacker holding only the app's publicly embedded Supabase publishable (anon) API key scripts repeated calls to the rescind_invitation RPC across a range of organization IDs. By observing whether each call returns NO_ORG or NO_RIGHTS, they compile a list of valid organizations and then launch targeted phishing against those tenants. No authentication, user interaction, or POC tooling is required - the publishable key is recoverable from any distributed client. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 15, 2026
Unauthenticated organization enumeration in Capgo before 12.128.2 lets attackers abuse the Supabase PostgREST SECURITY DEFINER RPC public.rescind_invitation, which returns distinguishable NO_ORG versus NO_RIGHTS errors when invoked with only a publishable (anon) API key. This oracle lets remote unauthenticated attackers confirm which organization IDs exist, building a target list for follow-on phishing and social engineering. Reported by VulnCheck; no public exploit code and no CISA KEV listing at time of analysis.
RemediationAI
Vendor-released patch: upgrade Capgo to 12.128.2 or later, which corrects the rescind_invitation function's error handling. Operators running self-hosted Capgo/Supabase instances should apply the corresponding database migration so the RPC returns a uniform, non-distinguishing error (or rejects anonymous callers) regardless of whether the organization exists, eliminating the NO_ORG versus NO_RIGHTS discrepancy. As interim compensating controls before patching, restrict or revoke anonymous access to the rescind_invitation RPC at the PostgREST/Row-Level-Security layer, or rate-limit and monitor calls from the publishable anon key to detect enumeration sweeps - trade-off is that tightening RLS on the anon role may break legitimate invitation flows and should be tested. Consult GHSA-8432-3cgm-vw5j (https://github.com/Cap-go/capgo/security/advisories/GHSA-8432-3cgm-vw5j) and the VulnCheck advisory for specifics.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Capgo is a live/over-the-air update service for Capacitor mobile apps that uses Supabase (PostgreSQL + PostgREST) as its backend. The flaw sits in a PostgreSQL function marked SECURITY DEFINER, meaning it executes with the privileges of the function owner rather than the caller, so it can read data the anonymous role normally cannot. Because rescind_invitation branches its error path - emitting NO_ORG when the organization does not exist and NO_RIGHTS when it exists but the caller lacks permission - the differing responses form a classic observable-discrepancy oracle (CWE-203), leaking existence state through side-channel error messages rather than through an intended data field.
Know when Capgo gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Unauthenticated network-reachable RPC with low complexity (PR:N/AV:N/AC:L), but it leaks only organization existence, so confidentiality is Low and integrity/availability are None.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Capgo (Cap-go/capgo) before 12.128.2 contains an information disclosure vulnerability in the Supabase PostgREST SECURITY DEFINER RPC function public.rescind_invitation that allows unauthenticated attackers to enumerate organization existence. The function returns distinct error messages (NO_ORG vs NO_RIGHTS) when called with only a publishable API key, enabling attackers to discover valid organization IDs and increase the attack surface for targeted phishing or social engineering campaigns.
Executive ViewAI
Capgo (mobile application build and deployment platform) contains an unauthenticated API vulnerability (CVE-2026-56339, CVSS 8.7) that allows remote attackers to enumerate organization IDs without authentication, enabling targeted social engineering and phishing campaigns. Organizations using Capgo face immediate reconnaissance risk, with no vendor patch currently available.
No vendor-released patch identified at time of analysis. Interim mitigations: rotate and restrict publishable API keys to internal networks only; implement rate limiting on public API endpoints; deploy monitoring for repeated API queries to organization endpoints; consider temporary service suspension if Capgo provides non-critical functionality.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Account pre-registration hijack in Capgo before 12.128.2 lets a remote unauthenticated attacker claim an account under a
Cross-domain SSO account takeover in Capgo before 12.128.2 allows an attacker with enterprise org admin access and a mal
Authentication bypass in Capgo prior to version 12.128.2 lets attackers defeat email-based OTP verification by tampering
Authentication bypass in Capgo before 12.128.2 lets remote unauthenticated attackers mint arbitrary API keys by tamperin
Rate-limit bypass in Capgo versions prior to 12.128.2 lets remote unauthenticated attackers flood the channel_self endpo
Cross-tenant data poisoning in Supabase Capgo before 12.128.2 allows remote unauthenticated attackers to corrupt billing
Server-side privilege escalation in Capgo before 12.128.2 lets authenticated users holding build permissions abuse a pat
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers query the /functions/v1/channel_se
Unauthenticated information disclosure in Capgo before 12.128.2 exposes confidential business metrics through the Supaba
Unauthenticated denial of service in Cap-go capgo (capgo-backend) before 12.128.12 allows remote attackers to exhaust Po
Account takeover in Capgo before 12.128.2 stems from a password-change endpoint that omits current-password validation (
Information disclosure in Capgo (Capacitor live-update/OTA platform) before 12.128.2 lets unauthenticated callers abuse
Exploit-DB