CVE-2026-56219: Capgo NULL-Auth Bypass Leaks Organization Membership and Roles

Technical summary

The vulnerability exists in the public.get_org_user_access_rbac function within Capgo's PostgREST RPC endpoint. The authorization gate performs an improper NULL comparison, failing to reject requests lacking valid authentication context. When an unauthenticated or insufficiently privileged request arrives with only a public API key, the NULL check does not block access, allowing the function to return RBAC role bindings and member email addresses that should be protected. The flaw stems from treating NULL as a valid authentication state rather than a denial condition.

Business impact

This disclosure vulnerability exposes organizational structure and personnel information to any attacker with network access. Leaked email addresses and role mappings facilitate targeted phishing, social engineering, and account takeover campaigns against high-privilege users. Organizations relying on Capgo for deployment or app management may experience reputational harm, regulatory exposure (GDPR, CCPA), and downstream attack surface expansion if exposed users become victims of credential compromise.

Affected systems

Capgo versions prior to 12.128.2 are affected. The vulnerability is accessible via the PostgREST RPC endpoint using a public API key, meaning any Capgo deployment running an unpatched version that exposes this endpoint is at risk. Organizations should verify their Capgo installation version and review whether the public.get_org_user_access_rbac endpoint is accessible from untrusted networks.

Exploitability

This vulnerability is highly exploitable. It requires no special privileges or credentials beyond a public API key, which may be obtainable or known. The attack is trivial to execute—a simple RPC call to the vulnerable function returns sensitive data. No user interaction, complex setup, or timing requirements exist. The low attack complexity and network-based attack vector make it a prime candidate for automated scanning and broad reconnaissance campaigns.

Remediation

Upgrade Capgo to version 12.128.2 or later. Organizations unable to upgrade immediately should implement network segmentation to restrict PostgREST endpoint access to trusted internal networks only, and monitor API logs for suspicious RPC calls to public.get_org_user_access_rbac. Review logs for evidence of prior exploitation and audit organization membership and roles for unauthorized changes.

Patch guidance

Apply Capgo version 12.128.2 or later as soon as possible. Verify the patch version in your deployment (check release notes or admin console version indicator) and confirm that the fix is present before considering the system remediated. If you are running a managed or SaaS version of Capgo, verify with your provider that the patch has been deployed to your tenant. Test in a non-production environment first to ensure no integration issues.

Detection guidance

Monitor Capgo logs and network traffic for calls to the public.get_org_user_access_rbac RPC endpoint, particularly from external IPs or unexpected sources. Check PostgREST access logs for authentication failures or NULL-valued authorization tokens. Implement alerting on unusual RPC endpoint activity. Query your Capgo audit trail for unauthorized role or membership data access. Correlate timestamps with any detected phishing or social engineering attempts against your organization.

Why prioritize this

Although not yet listed in CISA's KEV catalog, this vulnerability merits urgent patching because it directly leaks sensitive organizational data with trivial attack execution and no authentication barrier. The combination of high information disclosure impact, ease of exploitation, and potential to enable follow-on attacks (phishing, lateral movement) makes this a clear priority. Any organization using Capgo should treat this as a critical remediation target.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects high confidentiality impact (C:H) balanced against no integrity or availability impact. The attack vector is network-based, attack complexity is low, and no privileges or user interaction are required. The scope is unchanged. This score is appropriate given that the vulnerability exposes sensitive data at the organization level without enabling privilege escalation or system compromise, but the ease of exploitation and breadth of exposed information justify the HIGH severity classification.

Frequently asked questions