CVE-2026-56253: Capgo - Unauthenticated Organization Member Email Disclosure via get_org_members RPC
Capgo before 12.128.2 contains an improper access control vulnerability in the public.getorgmembers RPC function that allows unauthenticated attackers to enumerate organization members. Attackers can invoke the endpoint using only the public sbpublishable key and an organization UUID to retrieve sensitive member information including email addresses, user IDs, roles, and pending invitations.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56253?
The severity of CVE-2026-56253 is rated high with a score of 7.5.
How do I fix CVE-2026-56253?
To fix CVE-2026-56253, update Capgo to version 12.128.2 or later.
What does CVE-2026-56253 exploit?
CVE-2026-56253 exploits improper access controls in the get_org_members RPC function, allowing unauthenticated access.
What kind of data can be disclosed through CVE-2026-56253?
CVE-2026-56253 allows attackers to enumerate organization member emails.
Is authentication required to exploit CVE-2026-56253?
No, authentication is not required to exploit CVE-2026-56253.