CVE-2026-56279: Capgo - Information Disclosure via get_orgs_v7 RPC Endpoint
Capgo before 12.128.2 contains an information disclosure vulnerability in the getorgsv7(userid) RPC function that remains publicly invokable despite intended private access controls. Unauthenticated attackers can supply arbitrary user UUIDs to retrieve foreign users' organization membership, roles, management emails, and billing metadata.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56279?
CVE-2026-56279 has a severity rating of high, specifically an 8.7 on the CVSS scale.
How do I fix CVE-2026-56279?
To fix CVE-2026-56279, update Capgo to version 12.128.2 or later where the vulnerability has been addressed.
What kind of vulnerability is CVE-2026-56279?
CVE-2026-56279 is an information disclosure vulnerability that allows unauthorized access to user organization details.
Who can exploit the CVE-2026-56279 vulnerability?
Unauthenticated attackers can exploit CVE-2026-56279 due to the public accessibility of the vulnerable RPC endpoint.
What data can be exposed by CVE-2026-56279?
CVE-2026-56279 can expose sensitive information, including users' organization membership and roles.