CVE-2026-56279: Capgo Unauthenticated Information Disclosure in get_orgs_v7 RPC

Technical summary

The get_orgs_v7(userid) RPC endpoint in Capgo fails to enforce authentication checks, allowing unauthenticated callers to invoke it with arbitrary user UUIDs. The function returns sensitive organizational metadata including membership lists, role assignments, administrative contacts, and billing details. This represents a broken access control vulnerability (CWE-862) where a function intended for authenticated use remains publicly callable over the network. The vulnerability affects all instances running versions prior to 12.128.2.

Business impact

Organizations using Capgo face immediate exposure of their internal organizational structure, administrative hierarchy, and billing relationships. Competitors, social engineers, or threat actors can map organizational relationships and identify key decision-makers and administrative contacts without any authentication. For MSPs and enterprises managing multiple child organizations, the exposure is compounded across all managed accounts. Breach of this metadata can facilitate targeted phishing, pretexting, or supply-chain attacks against leadership and finance teams.

Affected systems

Capgo installations running versions prior to 12.128.2 are affected. The vulnerability is present in the RPC interface layer and affects all deployments regardless of network location or internal/external exposure—the endpoint responds to unauthenticated requests over the network. Organizations should identify all instances of Capgo in use and verify their installed version against the fixed baseline.

Exploitability

Exploitation requires only network access to the Capgo RPC endpoint and knowledge or enumeration of valid user UUIDs. No authentication, special credentials, or complex attack chains are necessary. The barrier to exploitation is extremely low: an attacker can write a simple script to iterate through potential user IDs and harvest organizational metadata. The vulnerability is likely already being probed by both opportunistic scanners and sophisticated threat actors. Exploit difficulty is minimal; impact is immediate and measurable.

Remediation

Upgrade Capgo to version 12.128.2 or later immediately. This version introduces authentication enforcement on the get_orgs_v7 endpoint, blocking unauthenticated access. Verify the patch is applied across all Capgo instances in your environment. As an interim measure before patching, if network architecture permits, restrict network access to the Capgo RPC endpoint using firewall rules or WAF policies to limit exposure to trusted internal networks only. However, patching is the only permanent remediation.

Patch guidance

Download and deploy Capgo 12.128.2 or later from the official Capgo vendor channels. Verify integrity of the release package. The fix is focused on adding authentication validation to the vulnerable RPC function and should not require data migration or complex configuration changes. Test the patch in a staging environment first to confirm no regression in legitimate RPC functionality. Apply patches to all affected instances as part of an expedited maintenance window—given the low attack difficulty, prioritize this over routine change windows. After patching, verify the fix by confirming that unauthenticated requests to get_orgs_v7 are rejected.

Detection guidance

Monitor RPC logs for calls to the get_orgs_v7 endpoint from unauthenticated or anonymous sessions. Look for repeated calls with different userid parameters, which may indicate enumeration activity. Check firewall and WAF logs for unusual traffic patterns to the Capgo RPC endpoint from external IP ranges. Review access logs for any get_orgs_v7 calls originating from non-internal networks. Hunt for outbound data exfiltration correlating with suspicious RPC access. Consider implementing request signing or mutual TLS if not already in place, and enable detailed logging of all RPC invocations with caller context.

Why prioritize this

This vulnerability merits immediate patching due to the combination of high CVSS score (7.5), zero authentication requirement, trivial exploitability, and direct exposure of business-sensitive organizational and billing metadata. The attack surface is the network layer—no user interaction, no complexity. Organizations managing sensitive client relationships or multi-tenant deployments face acute risk of competitive intelligence theft or social engineering attacks leveraging exposed administrative contacts. The low barrier to exploitation means active exploitation is probable.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects an unauthenticated network-based attack with low complexity, complete compromise of confidentiality (organizations, roles, contacts, billing data), and no impact to integrity or availability. The score appropriately captures the severity of unauthorized information disclosure. In contexts where Capgo manages high-value customer accounts or where organizational metadata carries strategic value, the business risk may exceed the numeric score.

Frequently asked questions