CVE-2026-56253: Capgo Improper Access Control Allows Unauthenticated Organization Member Enumeration

Technical summary

CVE-2026-56253 stems from improper access control in the public.get_org_members RPC endpoint within Capgo. The vulnerability arises because the function fails to enforce proper authentication checks before returning sensitive organizational membership data. An unauthenticated caller can invoke this endpoint by supplying a public sb_publishable_* key (which is inherently non-secret and often hardcoded in client applications) combined with a target organization's UUID. The endpoint then returns a complete member roster including email addresses, user identifiers, role assignments, and pending invitation states. The root cause maps to CWE-284 (Improper Access Control), indicating a failure to restrict operations to authorized principals.

Business impact

The exposure of organizational membership details creates several business risks. Competitors or reconnaissance actors can enumerate an organization's team structure, identify key personnel, and harvest email addresses for targeted phishing campaigns. The visibility into pending invitations may reveal upcoming team changes or hiring plans. For regulated organizations, this data leakage could trigger compliance violations if member information is subject to access controls under data protection frameworks. Reputationally, customers may view the ability to freely extract organizational rosters as a sign of weak security practices.

Affected systems

Capgo deployments running version 12.128.1 and earlier are vulnerable. Organizations using Capgo to manage team access, permissions, or organization hierarchies should assume their member lists are exposed until they upgrade to version 12.128.2 or later. Any deployment that relies on the sb_publishable_* API key scheme is at risk if the platform has not yet patched this issue.

Exploitability

This vulnerability is straightforward to exploit. It requires no authentication, no user interaction, and no special network conditions—only network access to the Capgo API endpoint. An attacker needs only to discover or guess an organization's UUID (which may be leaked in client-side code, error messages, or logs) and use the public API key already visible in the application. The barrier to exploitation is low, making this a likely vector for passive reconnaissance by threat actors scanning for organizational intelligence.

Remediation

Upgrade Capgo to version 12.128.2 or later, which restores proper access controls to the public.get_org_members endpoint. Verify with the Capgo vendor advisory that the patch version you deploy actually includes a fix for this specific RPC function. After patching, audit API access logs to identify whether the endpoint was queried by unauthorized callers during the exposure window. Review organizational data classification policies to determine whether member information should have been classified as sensitive from the outset.

Patch guidance

Prioritize upgrading to Capgo 12.128.2 as soon as practical. The fix is critical for any organization that treats member lists as confidential or sensitive. Perform the upgrade in a test environment first to confirm compatibility with your dependent applications and integrations. No workarounds exist; patching is the only remediation. After upgrading, validate that the public.get_org_members endpoint now correctly rejects unauthenticated requests or requests lacking the appropriate authorization context.

Detection guidance

Monitor API gateway or application logs for invocations of the public.get_org_members endpoint that originate from external IP addresses or lack valid authentication tokens. Look for patterns where a single caller queries the endpoint multiple times with different organization UUIDs—a sign of enumeration activity. If you have API key management tooling, review when and where your public sb_publishable_* keys are being used and from which networks. Compare historical API call patterns before and after the patch to identify anomalies that may indicate past exploitation.

Why prioritize this

Although the CVSS score is 7.5 (HIGH severity), this vulnerability should be prioritized highly in practice because exploitation is trivial, requires no special knowledge or interaction, and yields sensitive organizational data directly useful for follow-on attacks. Information disclosure vulnerabilities are often underestimated until they are chained with social engineering or other targeting techniques. The public availability of the sb_publishable_* key means any attacker with your application can trigger this endpoint.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects a high-severity information disclosure with a network vector (AV:N), low attack complexity (AC:L), no privilege requirements (PR:N), and no user interaction (UI:N). The impact is high confidentiality loss (C:H) with no integrity or availability impact (I:N, A:N). This score appropriately captures the severity of unrestricted member enumeration but does not account for the downstream social engineering or targeted phishing risk that often accompanies organizational roster exposure.

Frequently asked questions