CVE-2026-56226
HighCVSS 7.5Summary
A vulnerability in Capgo before version 12.128.2 allows unauthenticated attackers to access sensitive organizational data of users via the RPC function public.get_orgs_v6. This function, defined as SECURITY DEFINER and granted to the anon role, does not verify that the user UUID matches the authenticated context.
Risk Assessment
An attacker with only the public publishable API key can retrieve organization membership, roles, subscription/trial metadata, and management email (PII) of any user, leading to data confidentiality breaches and potential social engineering attacks.
Recommendation
Immediately upgrade Capgo to version 12.128.2 or later. Additionally, review the configuration of RPC functions in Supabase to ensure proper authorization and not rely solely on the public API key.
Original NVD description (English source)
Capgo (Cap-go/capgo) before 12.128.2 exposes the Supabase PostgREST RPC function public.get_orgs_v6(userid uuid), which is SECURITY DEFINER and granted to the anon role, allowing unauthenticated access. Because the function accepts a caller-supplied user UUID without verifying it matches the authenticated user, an attacker using only the public publishable API key can query POST /rest/v1/rpc/get_orgs_v6 with an arbitrary user UUID to retrieve that user's organization membership, roles, subscription/trial metadata, and management_email (PII).