CVE-2026-56339: Capgo Information Disclosure Vulnerability

CVE-2026-56339 Overview

CVE-2026-56339 affects Capgo (Cap-go/capgo) versions before 12.128.2. The vulnerability resides in the Supabase PostgREST SECURITY DEFINER RPC function public.rescind_invitation. The function returns distinct error responses (NO_ORG versus NO_RIGHTS) based on whether a supplied organization identifier exists. Unauthenticated attackers holding only a publishable API key can exploit this discrepancy to enumerate valid organization IDs. The flaw is classified under CWE-203: Observable Discrepancy.

Critical Impact
Unauthenticated attackers can enumerate valid Capgo organization identifiers, expanding the attack surface for targeted phishing, credential stuffing, and social engineering campaigns against organization administrators.

Affected Products

Capgo (Cap-go/capgo) versions prior to 12.128.2
Deployments exposing the Supabase PostgREST public.rescind_invitation RPC endpoint
Self-hosted Capgo instances relying on the publishable API key model

Discovery Timeline

2026-07-15 - CVE-2026-56339 published to the National Vulnerability Database (NVD)
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-56339

Vulnerability Analysis

Capgo exposes the public.rescind_invitation RPC through Supabase PostgREST. The function is declared with SECURITY DEFINER, meaning it executes with the privileges of the function owner rather than the caller. When invoked with only a publishable (anonymous) API key, the function performs internal lookups before authorization checks fully gate the response.

The function returns two distinguishable error codes depending on internal state. NO_ORG is returned when the supplied organization identifier does not exist. NO_RIGHTS is returned when the organization exists but the caller lacks permission. This observable discrepancy converts an authorization error path into an oracle for organization existence.

An unauthenticated caller can iterate candidate organization UUIDs against the RPC and separate valid tenants from invalid ones based purely on the returned error string. The disclosed data assists reconnaissance for downstream attacks such as targeted phishing of Capgo customers.

Root Cause

The root cause is an information disclosure through error message differentiation inside a SECURITY DEFINER RPC. The function evaluates existence before, or independently from, the caller's authorization context and reflects that evaluation back to the client. The publishable API key intended for anonymous frontend usage is sufficient to reach the RPC, so no authentication barrier gates the oracle.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker acquires a Capgo publishable API key (embedded in any client application) and issues HTTP POST requests to the PostgREST endpoint for rescind_invitation. The attacker supplies candidate organization IDs and classifies the response by the returned error string. Iterating across a UUID space is impractical at random, but the technique is effective against leaked, guessed, or partially known identifiers, and against sequential deployments.

No verified public exploit code is available. See the GitHub Security Advisory GHSA-8432-3cgm-vw5j and the VulnCheck Advisory for technical details.

Detection Methods for CVE-2026-56339

Indicators of Compromise

High-volume POST requests to the Supabase PostgREST path /rest/v1/rpc/rescind_invitation from a single source IP or ASN
Requests to rescind_invitation authenticated only with the publishable apikey header and no user JWT
Response logs showing repeated NO_ORG and NO_RIGHTS error codes correlated to the same client

Detection Strategies

Enable PostgREST and Supabase edge logging to capture RPC calls, source IPs, request headers, and returned error codes
Baseline normal invocation rates for rescind_invitation and alert on statistically anomalous request volumes from unauthenticated callers
Correlate publishable-key-only traffic against RPC endpoints that should require an authenticated session token

Monitoring Recommendations

Ingest Supabase and PostgREST logs into a centralized SIEM or data lake for retention and query
Build detection rules that flag enumeration patterns such as many distinct org_id values queried per minute per source
Monitor for reconnaissance behavior against exposed RPC surfaces and pivot to identity telemetry when organization IDs are subsequently used in phishing indicators

How to Mitigate CVE-2026-56339

Immediate Actions Required

Upgrade Capgo (Cap-go/capgo) to version 12.128.2 or later
Audit all SECURITY DEFINER RPC functions for observable error discrepancies that leak existence or state
Rotate publishable API keys if enumeration activity is observed in historical logs

Patch Information

The maintainers addressed the flaw in Capgo 12.128.2. The fix normalizes error responses from public.rescind_invitation so that unauthorized and non-existent organization requests return an indistinguishable result. Review the GitHub Security Advisory GHSA-8432-3cgm-vw5j for upgrade instructions and commit references.

Workarounds

Restrict invocation of the rescind_invitation RPC to authenticated sessions by enforcing a JWT check inside the function before any lookup
Return a single, generic error string for both missing-organization and insufficient-privilege cases until the upgrade is applied
Apply rate limiting at the PostgREST or upstream proxy layer to constrain enumeration throughput

bash

# Example PostgREST rate limit via reverse proxy (nginx)
limit_req_zone $binary_remote_addr zone=rpc_zone:10m rate=10r/m;

location /rest/v1/rpc/rescind_invitation {
    limit_req zone=rpc_zone burst=5 nodelay;
    proxy_pass http://postgrest_upstream;
}