CVE-2026-56339: Cap-Go Capgo

High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days.

Capgo (Cap-go/capgo) before 12.128.2 contains an information disclosure vulnerability in the Supabase PostgREST SECURITY DEFINER RPC function public.rescind_invitation that allows unauthenticated attackers to enumerate organization existence. The function returns distinct error messages (NO_ORG vs NO_RIGHTS) when called with only a publishable API key, enabling attackers to discover valid organization IDs and increase the attack surface for targeted phishing or social engineering campaigns.

Affected products

• Cap-Go Capgo: before 12.128.2 (fixed in 12.128.2)

Published 2026-07-15. Last modified 2026-07-15.