CVE-2026-56279 Overview
CVE-2026-56279 is an information disclosure vulnerability in Capgo before version 12.128.2. The flaw resides in the get_orgs_v7(userid) Remote Procedure Call (RPC) function, which remains publicly invokable despite intended private access controls. Unauthenticated attackers can supply arbitrary user Universally Unique Identifiers (UUIDs) to enumerate foreign users' organization memberships, roles, management emails, and billing metadata. The vulnerability is classified under Common Weakness Enumeration [CWE-862] (Missing Authorization). Because exploitation requires no authentication, privileges, or user interaction, any attacker with network access to the Capgo backend can retrieve sensitive multi-tenant data.
Critical Impact
Unauthenticated remote attackers can harvest organization membership, roles, administrative email addresses, and billing metadata for arbitrary Capgo users by invoking the exposed RPC endpoint.
Affected Products
- Capgo versions prior to 12.128.2
- Deployments exposing the get_orgs_v7 RPC endpoint
- Multi-tenant Capgo installations with organization metadata
Discovery Timeline
- 2026-07-10 - CVE-2026-56279 published to the National Vulnerability Database (NVD)
- 2026-07-10 - Last updated in the NVD database
Technical Details for CVE-2026-56279
Vulnerability Analysis
The vulnerability is a Missing Authorization flaw in the Capgo backend RPC layer. The get_orgs_v7(userid) function was intended to be invoked only in privileged contexts but was left publicly callable. Callers pass a userid UUID as an argument, and the function returns organization data associated with that user without validating whether the caller has permission to view it.
Exposed data includes organization membership lists, per-user roles, management email addresses, and billing metadata. This provides attackers with reconnaissance material for follow-on attacks such as spear-phishing, business email compromise, and targeted credential attacks against organization administrators.
Root Cause
The root cause is the absence of an authorization check between the RPC entry point and the underlying data query. Access control policies expected to filter results by the caller's identity are not enforced when the endpoint is invoked without an authenticated session. See the GitHub Security Advisory for the maintainer's technical description.
Attack Vector
Exploitation occurs over the network against the publicly reachable RPC endpoint. An attacker enumerates or obtains target user UUIDs and issues RPC calls to get_orgs_v7 for each UUID. No credentials, tokens, or user interaction are required. Refer to the VulnCheck Security Advisory for additional context.
// No verified proof-of-concept code is available.
// The vulnerability is triggered by invoking the get_orgs_v7(userid)
// RPC endpoint with an arbitrary user UUID as the sole argument.
Detection Methods for CVE-2026-56279
Indicators of Compromise
- Unauthenticated RPC requests targeting the get_orgs_v7 function in backend access logs
- High-volume enumeration of distinct userid UUID values from a single client
- Anomalous outbound egress of organization or billing metadata records
Detection Strategies
- Inspect API and RPC gateway logs for calls to get_orgs_v7 originating from unauthenticated sessions or unexpected source addresses
- Correlate RPC call volumes with authenticated session counts to identify enumeration behavior
- Alert on repeated calls to the same RPC endpoint with rapidly varying UUID arguments
Monitoring Recommendations
- Enable verbose logging on all RPC endpoints handling user or organization data
- Track unique UUID arguments observed per source IP over rolling time windows
- Forward RPC access logs to a centralized analytics platform for anomaly baselining
How to Mitigate CVE-2026-56279
Immediate Actions Required
- Upgrade Capgo to version 12.128.2 or later without delay
- Audit access logs for prior invocations of get_orgs_v7 and identify UUIDs that were queried
- Notify affected organization administrators whose management emails or billing metadata may have been disclosed
Patch Information
Capgo maintainers released a fix in version 12.128.2 that restricts get_orgs_v7 invocation to authorized callers. Deployment instructions are available in the GitHub Security Advisory GHSA-fch8-pp28-mw2x.
Workarounds
- Restrict network access to the RPC endpoint using upstream authentication proxies or web application firewall rules
- Revoke public execution permissions on the get_orgs_v7 function at the database or RPC-layer policy level
- Rotate management email notification addresses and review billing metadata exposure for affected tenants
# Example: upgrade Capgo to the patched release
npm install @capgo/capgo@12.128.2
# Verify the installed version
npm list @capgo/capgo
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
