CVE-2026-56226: Capgo - Unauthenticated Organization Data Disclosure via get_orgs_v6 RPC
Capgo (Cap-go/capgo) before 12.128.2 exposes the Supabase PostgREST RPC function public.getorgsv6(userid uuid), which is SECURITY DEFINER and granted to the anon role, allowing unauthenticated access. Because the function accepts a caller-supplied user UUID without verifying it matches the authenticated user, an attacker using only the public publishable API key can query POST /rest/v1/rpc/getorgsv6 with an arbitrary user UUID to retrieve that user's organization membership, roles, subscription/trial metadata, and managementemail (PII).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56226?
The severity of CVE-2026-56226 is rated high with a score of 8.7.
How do I fix CVE-2026-56226?
To fix CVE-2026-56226, upgrade Capgo to version 12.128.2 or later, which addresses the unauthenticated data disclosure.
What type of vulnerability is CVE-2026-56226?
CVE-2026-56226 is categorized as an information leak vulnerability.
What kind of data can be disclosed due to CVE-2026-56226?
CVE-2026-56226 allows unauthorized access to organization data via the get_orgs_v6 RPC function.
Who is affected by CVE-2026-56226?
Any user of Capgo prior to version 12.128.2 is potentially affected by CVE-2026-56226.