CVE-2026-56339 · Symaro Security Advisory

Description

Capgo (Cap-go/capgo) before 12.128.2 contains an information disclosure vulnerability in the Supabase PostgREST SECURITY DEFINER RPC function public.rescind_invitation that allows unauthenticated attackers to enumerate organization existence. The function returns distinct error messages (NO_ORG vs NO_RIGHTS) when called with only a publishable API key, enabling attackers to discover valid organization IDs and increase the attack surface for targeted phishing or social engineering campaigns.

Severity (CVSS)

Base score	8.7
Severity	High
Version	CVSS 4.0
Vector	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Provided by	CNA

Weaknesses

CWE-203 — Observable Discrepancy

Affected products

Vendor	Product	Versions
Cap-go	capgo	0 to <12.128.2; 12.128.2

References

https://github.com/Cap-go/capgo/security/advisories/GHSA-8432-3cgm-vw5j (vendor-advisory)
https://www.vulncheck.com/advisories/capgo-unauthenticated-organization-existence-enumeration-via-rescind-invitation-rpc (third-party-advisory)

Authoritative sources

This page is a snapshot. For the latest enrichment and updates, view the record on CVE.org or the NVD.

Generated from the official CVE List on 16 Jul 2026 07:01 UTC.