CVE-2026-56226: Capgo Unauthenticated User Data Exposure via PostgREST RPC

Technical summary

The vulnerability stems from improper exposure of the Supabase PostgREST RPC endpoint public.get_orgs_v6(userid uuid). This function is marked SECURITY DEFINER and granted to the anonymous role, enabling unauthenticated callers to invoke it. The function fails to validate that the requested user UUID matches the authenticated caller, permitting arbitrary user data enumeration via POST /rest/v1/rpc/get_orgs_v6 using only the public publishable API key. The exposed data includes organization membership records, role assignments, subscription and trial metadata, and management email addresses (personally identifiable information).

Business impact

Organizations using Capgo before 12.128.2 face exposure of user directory information and subscription details to any attacker with network access. This enables social engineering, competitive intelligence gathering, and targeted account compromise attempts. The disclosure of management email addresses and subscription status could facilitate phishing campaigns or subscription fraud. For SaaS operators, this leakage undermines customer privacy commitments and may trigger incident notification obligations depending on regulatory scope and data classification policies.

Affected systems

Capgo versions prior to 12.128.2 are affected. The vulnerability is present in the Supabase PostgREST integration layer and affects any deployment where the public.get_orgs_v6 RPC function remains exposed to the anonymous role without proper access controls.

Exploitability

Exploitation requires minimal sophistication: an attacker needs only the public API key (which is intentionally public by design) and knowledge of or ability to enumerate user UUIDs. No authentication, special privileges, or user interaction is necessary. The attack is performed over the network with low complexity, making it easily weaponizable at scale. An attacker can systematically query the endpoint with different UUID values to harvest organization metadata for multiple users.

Remediation

Upgrade Capgo to version 12.128.2 or later, which patches the authorization flaw. Verify against the vendor advisory for any additional configuration changes required. As a temporary mitigation pending upgrade, review Supabase PostgREST policies to restrict the anonymous role's access to the get_orgs_v6 function and implement database-level access controls limiting RPC invocation to authenticated users. Monitor RPC endpoint logs for suspicious patterns of UUID enumeration.

Patch guidance

Update Capgo to 12.128.2 or a later stable release. Review release notes for any breaking changes or post-upgrade validation steps. If you manage a self-hosted Supabase instance alongside Capgo, ensure the PostgREST configuration is synchronized with the patched version to prevent regression. Test in a staging environment before production deployment to confirm the fix does not disrupt legitimate organization lookup workflows.

Detection guidance

Monitor Supabase PostgREST access logs for repeated calls to /rest/v1/rpc/get_orgs_v6 with varying user UUID parameters, particularly from single source IPs or API keys. Alert on requests from unauthenticated sessions or those originating outside expected geographic or network ranges. Review CloudWatch or audit logs for spikes in RPC endpoint invocations that deviate from baseline user behavior. Query database logs for calls to public.get_orgs_v6 executed by the anonymous role; legitimate traffic should be minimal or absent post-patch.

Why prioritize this

This vulnerability merits urgent remediation due to its HIGH CVSS score (7.5), zero authentication requirement, and direct exposure of sensitive business and personal data. The attack is trivial to execute at scale, and the exposed information (email addresses, subscription status) is immediately actionable for follow-on attacks. The lack of KEV (Known Exploited Vulnerability) status does not diminish risk; the simplicity of exploitation means threat actors will quickly weaponize this if not patched across deployments.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects a network-accessible vulnerability with no authentication or user interaction required, resulting in high confidentiality impact. The severity is not CRITICAL because no integrity or availability impact occurs (data is read-only exposure). However, the real-world risk is acute: the information disclosed is sensitive enough to enable downstream account compromise, and the barrier to exploitation is nonexistent. Organizations should treat this as CRITICAL in their internal prioritization frameworks if their user base or subscription details are considered sensitive assets.

Frequently asked questions