CVE-2026-56327 Overview
CVE-2026-56327 is an information disclosure vulnerability affecting Capgo versions prior to 12.128.2. The flaw resides in the public.invite_user_to_org Remote Procedure Call (RPC) function, which returns distinct error responses that reveal whether an organization identifier exists. Unauthenticated attackers holding only a publishable API key can call this SECURITY DEFINER function and differentiate between NO_ORG and NO_RIGHTS responses. This behavior creates an oracle that enables tenant enumeration across the multi-tenant Capgo platform [CWE-203].
Critical Impact
Unauthenticated attackers can enumerate the existence of arbitrary organization IDs in Capgo tenants using only a publishable API key, exposing tenant structure for follow-on targeting.
Affected Products
- Capgo versions prior to 12.128.2
- The public.invite_user_to_org RPC function
- Supabase-backed deployments exposing the affected SECURITY DEFINER function
Discovery Timeline
- 2026-06-30 - CVE-2026-56327 published to the National Vulnerability Database (NVD)
- 2026-07-01 - Last updated in NVD database
Technical Details for CVE-2026-56327
Vulnerability Analysis
Capgo is an open-source live update platform for Capacitor mobile applications. The public.invite_user_to_org RPC is exposed through the platform's PostgREST-style API and executes with elevated database privileges as a SECURITY DEFINER function. This design allows callers holding only a publishable (anonymous) API key to reach the function without authenticating as a user.
When invoked with an arbitrary organization identifier, the function evaluates two conditions sequentially. It first checks whether the referenced organization exists. If the organization is missing, the function returns a NO_ORG error. If the organization exists but the caller lacks invitation rights, it returns a NO_RIGHTS error. This distinction between error paths forms an observable side channel classified as an Observable Discrepancy [CWE-203].
Attackers can iterate through candidate organization IDs and record which values return NO_RIGHTS versus NO_ORG. The result is a full enumeration of valid tenants on the target instance, which supports downstream reconnaissance, targeted phishing of tenant administrators, and preparation for authenticated attacks.
Root Cause
The root cause is inconsistent error handling in an unauthenticated code path. The SECURITY DEFINER function differentiates responses based on the existence of a resource before authorization checks complete. Combined with public reachability via the publishable API key, this differentiation converts an authorization decision into an existence oracle.
Attack Vector
Exploitation requires only network access to the Capgo API and a publishable API key, which is treated as public. An attacker submits repeated RPC calls to public.invite_user_to_org with candidate organization UUIDs. By classifying each response as NO_ORG or NO_RIGHTS, the attacker builds a list of valid organizations without any user credentials. No user interaction is required, and no data beyond error strings is disclosed. Refer to the GitHub Security Advisory GHSA-35q8-ghfg-vp6m and the VulnCheck Advisory for technical details.
Detection Methods for CVE-2026-56327
Indicators of Compromise
- High-volume RPC calls to public.invite_user_to_org originating from a single client or API key within a short time window.
- Repeated calls containing sequential or randomized organization UUIDs that do not correspond to the caller's known tenant.
- Elevated ratios of NO_ORG and NO_RIGHTS error responses in PostgREST or Supabase logs.
Detection Strategies
- Aggregate PostgREST access logs by API key and RPC name to baseline normal invite_user_to_org usage and alert on deviations.
- Correlate error-response distributions per source IP to identify enumeration patterns that mix NO_ORG and NO_RIGHTS outcomes.
- Track publishable API key usage against unusual endpoints, since these keys should rarely trigger organization invitation flows.
Monitoring Recommendations
- Enable request-level logging on the Supabase or PostgREST layer for all RPC functions marked SECURITY DEFINER.
- Forward API gateway and database logs to a centralized analytics platform for retention and correlation with authentication telemetry.
- Alert on any single source generating more than a defined threshold of failed invite_user_to_org calls per minute.
How to Mitigate CVE-2026-56327
Immediate Actions Required
- Upgrade Capgo to version 12.128.2 or later, which unifies the error responses returned by public.invite_user_to_org.
- Rotate publishable API keys that have been observed generating large volumes of RPC errors.
- Review PostgREST logs for enumeration activity predating the upgrade and record any confirmed tenant IDs harvested.
Patch Information
The vendor released a fix in Capgo 12.128.2. The patch modifies public.invite_user_to_org so that both non-existent organizations and insufficient rights return an identical response, removing the observable discrepancy. Administrators should follow upgrade instructions in the GitHub Security Advisory GHSA-35q8-ghfg-vp6m.
Workarounds
- Restrict access to the public.invite_user_to_org RPC at the API gateway to authenticated sessions only until the patch is applied.
- Apply per-key rate limiting on publishable API keys to slow enumeration attempts against the RPC endpoint.
- Wrap the RPC in a database function that returns a uniform error message regardless of organization existence or permission state.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
