CVE-2026-56253: Capgo Information Disclosure Vulnerability

CVE-2026-56253 Overview

Capgo before version 12.128.2 contains an improper access control vulnerability [CWE-284] in the public.get_org_members Remote Procedure Call (RPC) function. The flaw allows unauthenticated attackers to enumerate organization members using only a public sb_publishable_* key and an organization Universally Unique Identifier (UUID). Successful exploitation discloses email addresses, user IDs, role assignments, and pending invitations. The vulnerability impacts confidentiality without requiring authentication or user interaction. Capgo is an open-source platform for live updates of Capacitor applications, and exposed member data can fuel targeted phishing or account takeover campaigns against organization administrators.

Critical Impact
Unauthenticated attackers can harvest organization member email addresses, user IDs, roles, and pending invitations from any Capgo instance running a version earlier than 12.128.2.

Affected Products

Capgo versions prior to 12.128.2
Capgo self-hosted deployments using the vulnerable public.get_org_members RPC
Capgo organizations accessible via the sb_publishable_* publishable key

Discovery Timeline

2026-06-21 - CVE-2026-56253 published to the National Vulnerability Database (NVD)
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-56253

Vulnerability Analysis

The vulnerability resides in the public.get_org_members Postgres RPC function exposed through the Capgo backend. The endpoint lacks server-side authorization checks tying the caller to an organization membership. Any client holding the public sb_publishable_* key, which Capgo distributes to front-end and Software Development Kit (SDK) consumers, can invoke the RPC. Supplying an organization UUID returns the full member roster, including email addresses, user IDs, role values, and pending invitations. This converts a publicly distributable client key into a credential capable of reading sensitive directory data. The disclosed information enables reconnaissance for credential stuffing, business email compromise, and impersonation of pending invitees.

Root Cause

The RPC implements improper access control by treating possession of the publishable key as sufficient authorization. Capgo did not enforce row-level security or session-bound checks verifying that the caller belonged to the requested organization. The publishable key is designed for anonymous client use, so any visitor to a Capgo-powered application can extract it from network traffic or bundled JavaScript.

Attack Vector

An attacker obtains the publishable key from a public web bundle or browser request and identifies a target organization UUID through open-source intelligence or sequential enumeration. The attacker then issues an HTTPS POST to the Capgo RPC endpoint, passing the organization UUID as a parameter and the publishable key in the apikey header. The server returns a JavaScript Object Notation (JSON) array of member records. No authentication token, session cookie, or user interaction is required, and the request leaves no failed-authentication signal in standard logs.

The vulnerability is described in prose because no verified proof-of-concept code has been released. See the GitHub Security Advisory and the VulnCheck Advisory for additional technical context.

Detection Methods for CVE-2026-56253

Indicators of Compromise

Repeated POST requests to the /rest/v1/rpc/get_org_members endpoint originating from a single IP address or autonomous system.
Requests carrying the sb_publishable_* key without an accompanying user Authorization bearer token.
Enumeration patterns iterating through multiple organization UUIDs in a short window.

Detection Strategies

Inspect reverse-proxy and Postgres logs for invocations of public.get_org_members that lack an authenticated auth.uid() context.
Alert on response payloads from the RPC endpoint that contain email addresses returned to anonymous sessions.
Correlate publishable-key usage with geographic and User-Agent anomalies to surface scraping behavior.

Monitoring Recommendations

Forward Capgo and underlying Supabase API gateway logs to a centralized Security Information and Event Management (SIEM) platform with long retention.
Establish baseline request volumes for the get_org_members RPC and trigger alerts on deviations.
Track the distribution of organization UUIDs queried per source IP to detect enumeration sweeps.

How to Mitigate CVE-2026-56253

Immediate Actions Required

Upgrade Capgo to version 12.128.2 or later on all self-hosted and managed deployments.
Rotate the sb_publishable_* key after upgrading to invalidate any keys harvested by attackers.
Audit organization member rosters and recent invitations for unauthorized changes or unexpected access.
Notify members whose email addresses may have been disclosed so they can heighten phishing vigilance.

Patch Information

The Capgo maintainers fixed the issue in release 12.128.2 by enforcing membership checks inside the public.get_org_members RPC. Patch details and remediation guidance are documented in the GitHub Security Advisory GHSA-x34h-gc65-f6g4.

Workarounds

Revoke or restrict the public.get_org_members RPC at the database layer until the upgrade is applied.
Add row-level security policies that require auth.uid() to match an existing membership row before returning data.
Place a Web Application Firewall (WAF) rule in front of the Capgo API to block anonymous calls to the get_org_members endpoint.

bash

# Configuration example: revoke anonymous access to the vulnerable RPC
REVOKE EXECUTE ON FUNCTION public.get_org_members(uuid) FROM anon;
REVOKE EXECUTE ON FUNCTION public.get_org_members(uuid) FROM PUBLIC;
GRANT EXECUTE ON FUNCTION public.get_org_members(uuid) TO authenticated;