CVE-2026-56219: Capgo Auth Bypass Vulnerability

CVE-2026-56219 Overview

CVE-2026-56219 is a NULL-auth bypass vulnerability in Capgo versions before 12.128.2. The flaw resides in the public.get_org_user_access_rbac function, which contains an improper NULL comparison in its authorization gate. Unauthenticated attackers holding only a public API key can invoke the PostgREST Remote Procedure Call (RPC) endpoint to retrieve Role-Based Access Control (RBAC) role bindings and organization member email addresses. The vulnerability maps to [CWE-287: Improper Authentication] and enables disclosure of organization membership, role assignments, and personal email data without any credentials.

Critical Impact
Unauthenticated attackers can enumerate organization RBAC bindings and member emails using only a public API key, exposing sensitive identity data.

Affected Products

Capgo versions prior to 12.128.2
Deployments exposing the public.get_org_user_access_rbac PostgREST RPC endpoint
Self-hosted Capgo instances relying on the vulnerable authorization gate

Discovery Timeline

2026-06-30 - CVE-2026-56219 published to the National Vulnerability Database (NVD)
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-56219

Vulnerability Analysis

The vulnerability exists in the public.get_org_user_access_rbac PostgreSQL function used by Capgo to enforce organization-level RBAC checks. The function's authorization gate compares the caller's identity using a NULL-unsafe expression. When an unauthenticated request arrives via PostgREST, the caller identity resolves to NULL, and the comparison returns NULL rather than FALSE. PostgREST treats the missing FALSE result as passing the gate, allowing the function body to execute with elevated context. The function then returns RBAC role bindings and associated member email addresses to the caller. Because the endpoint is exposed as a public RPC, an attacker only needs the public anon API key that Capgo distributes to browser clients. This turns an authorization-only weakness into a large-scale identity disclosure primitive across every organization stored in the database.

Root Cause

The root cause is an improper NULL comparison inside the SQL authorization predicate. Standard SQL semantics evaluate NULL = value and NULL <> value as NULL, not FALSE. The gate treats a non-FALSE outcome as authorized, granting unauthenticated callers access to protected rows.

Attack Vector

An attacker sends an unauthenticated HTTP POST to the PostgREST RPC endpoint for get_org_user_access_rbac, supplying a target organization identifier and the public anon API key. The server executes the function, bypasses the broken gate, and returns JSON containing role bindings and email addresses. No user interaction, session, or privileged credential is required.

No verified public proof-of-concept code is available. See the GitHub Security Advisory and the VulnCheck Advisory for technical details.

Detection Methods for CVE-2026-56219

Indicators of Compromise

Unauthenticated PostgREST requests to /rest/v1/rpc/get_org_user_access_rbac from unfamiliar source IPs.
Requests carrying only the public anon API key and no Authorization: Bearer JWT.
High-volume enumeration of distinct org_id values against the RPC endpoint within short time windows.
Outbound response payloads containing large lists of member email addresses correlated with anon-key requests.

Detection Strategies

Review PostgREST and reverse-proxy access logs for calls to get_org_user_access_rbac originating from anonymous sessions.
Alert on any RPC call to RBAC-related functions where the JWT role claim equals anon.
Baseline normal callers of the function and flag deviations in source IP, User-Agent, or request rate.

Monitoring Recommendations

Ingest PostgREST, PostgreSQL, and CDN logs into a centralized analytics platform for correlation.
Monitor for repeated 200-OK responses to anon-key RPC calls returning non-empty result sets.
Track error-rate and row-count metrics on the get_org_user_access_rbac function to detect scraping behavior.

How to Mitigate CVE-2026-56219

Immediate Actions Required

Upgrade Capgo to version 12.128.2 or later, which corrects the authorization gate.
Revoke and rotate any exposed service-role keys and audit recent anon-key traffic against the RBAC RPC.
Restrict PostgREST exposure of get_org_user_access_rbac to authenticated roles only until the patch is applied.

Patch Information

Capgo maintainers released the fix in version 12.128.2. Refer to the GitHub Security Advisory GHSA-vvm7-xhcj-m94h for patch commits and upgrade instructions.

Workarounds

Revoke EXECUTE privileges on public.get_org_user_access_rbac from the anon role until upgrading.
Add an explicit auth.uid() IS NOT NULL guard at the top of the function to fail closed on NULL identity.
Place a network- or gateway-level rule blocking unauthenticated calls to the affected RPC path.

bash

# Configuration example: revoke anon execute on the vulnerable RPC
REVOKE EXECUTE ON FUNCTION public.get_org_user_access_rbac(uuid)
  FROM anon;

# Optional hardening inside the function body
# IF auth.uid() IS NULL THEN
#   RAISE EXCEPTION 'unauthenticated';
# END IF;