CVE-2026-56327: Capgo Organization Enumeration Vulnerability

Technical summary

The vulnerability exists in the public.invite_user_to_org RPC function, which is a SECURITY DEFINER stored procedure that should restrict access but fails to properly validate the caller's authorization before disclosing sensitive information. When an attacker submits requests using a publishable API key (which is intentionally public), the function returns distinguishable error responses: a NO_ORG error when an organization ID does not exist, and a NO_RIGHTS error when the organization exists but the caller lacks permission. This differential error response leaks information about the existence of organizations in the system. The root cause is improper information disclosure (CWE-203), where implementation details that should remain hidden are exposed through side-channel information in error handling.

Business impact

This vulnerability enables tenant enumeration, allowing competitors, malicious actors, or market researchers to discover which organizations use Capgo. While not immediately leading to data theft or system compromise, enumeration attacks often serve as reconnaissance for subsequent social engineering, targeted phishing, or follow-up attacks against identified organizations. For Capgo customers concerned about operational security, this represents a reputational and strategic risk if their use of the platform becomes discoverable through automated scanning.

Affected systems

Capgo versions prior to 12.128.2 are affected. Organizations running Capgo in any capacity—whether as a self-hosted deployment or as part of a managed service—should assume the vulnerable code is present until they upgrade. The vulnerability is accessible to any Internet-facing deployment, since the affected function accepts unauthenticated requests with publishable API keys.

Exploitability

Exploitability is straightforward. An attacker requires only network access to the Capgo instance, a publishable API key (which is designed to be non-secret), and the ability to make repeated function calls. No authentication is required, no unusual network conditions must be present, and no user interaction is needed. The attack is entirely automated and can enumerate thousands of organization IDs in minutes. The CVSS score of 5.3 (MEDIUM) reflects the low barrier to exploitation and network accessibility, tempered by the fact that only information disclosure occurs—no data theft, modification, or denial of service.

Remediation

Upgrade Capgo to version 12.128.2 or later. This version fixes the underlying authorization logic in the public.invite_user_to_org function to avoid leaking organization existence through error responses. Prior to upgrading, consider restricting network access to the Capgo RPC endpoint if possible, or implementing a rate-limiting proxy to reduce the speed of enumeration attacks.

Patch guidance

Apply the upgrade to version 12.128.2 as soon as feasible. This is a straightforward version update with no reported breaking changes. Verify the upgrade has been applied by checking the Capgo version string in your deployment (typically accessible via the admin console or API). If you are unable to upgrade immediately, implement network-layer controls (firewall rules, reverse proxy authentication) to limit exposure of the RPC endpoint.

Detection guidance

Monitor logs for repeated calls to the public.invite_user_to_org function, especially from the same source IP or with a pattern of sequential or enumerated organization IDs. A single attacker probing for organization existence may generate hundreds of requests within minutes. Baseline normal usage of this function in your environment and alert on anomalies. Additionally, review recent access logs for any enumeration attempts post-publication of this advisory (after 2026-06-30).

Why prioritize this

While the CVSS score is MEDIUM, prioritization depends on your threat model. If your Capgo deployment is internal-only or behind a VPN, risk is lower. If Capgo is internet-facing and you operate in a competitive or sensitive vertical (finance, healthcare, defense), prioritize patching to prevent reconnaissance by adversaries. The vulnerability does not appear on the CISA KEV catalog, indicating no active exploitation in the wild as of the advisory date, but this does not mean attacks are impossible—only that they have not been widely reported.

Risk score, explained

The CVSS 3.1 score of 5.3 reflects: Attack Vector = Network (attackers need only Internet access), Attack Complexity = Low (no special conditions required), Privileges Required = None (unauthenticated access allowed), User Interaction = None (no human action needed), Scope = Unchanged (impact is confined to Capgo), Confidentiality Impact = Low (organization IDs and existence are disclosed, but no user data or credentials leak directly). Integrity and Availability are unaffected. The MEDIUM severity signals that patching is necessary but not emergency-critical in most contexts.

Frequently asked questions