CVE-2026-56327

Summary

Capgo before 12.128.2 contains an information disclosure vulnerability in the public.invite_user_to_org RPC function that allows unauthenticated attackers to enumerate organization existence by observing distinct error responses. Attackers can call the SECURITY DEFINER function with a publishable API key to determine if an organization ID exists based on NO_ORG versus NO_RIGHTS responses, enabling tenant enumeration attacks.

Affected Software

Weaknesses

• CWE-203: Observable Discrepancy

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: yes
  • Technical Impact: partial

Additional References

• https://github.com/Cap-go/capgo/security/advisories/GHSA-35q8-ghfg-vp6m

References

• https://github.com/Cap-go/capgo/security/advisories/GHSA-35q8-ghfg-vp6m
• https://www.vulncheck.com/advisories/capgo-unauthenticated-organization-existence-oracle-via-public-invite-user-to-org-rpc

• ←Previous
• Next→