CVE-2026-56321: Capgo - Missing Authentication Middleware on GET /private/role_bindings Endpoint
Capgo (backend Supabase edge functions) before 12.128.2 does not apply the global authentication middleware to the GET /private/rolebindings/:orgid endpoint, unlike the POST and DELETE rolebindings routes, so unauthenticated requests reach the handler instead of being rejected at the middleware layer. The handler still performs its own authorization check and returns Unauthorized, so no direct data exposure occurs; the flaw is inconsistent authentication enforcement across HTTP methods that could enable authorization bypass if the handler logic changes.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Capgo (backend Supabase edge functions)to a version that resolves this vulnerability.Fixed in 12.128.2 - Configuration
Apply the global authentication middleware to the GET /private/role_bindings/:org_id endpoint so unauthenticated requests are rejected at the middleware layer (make GET consistent with POST and DELETE role_bindings routes).
Capgo (backend Supabase edge functions) global_authentication_middleware on GET /private/role_bindings/:org_id = applied/enabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56321?
CVE-2026-56321 is rated as medium severity with a score of 6.9.
How do I fix CVE-2026-56321?
To fix CVE-2026-56321, update Capgo to version 12.128.2 or later where the authentication middleware is correctly applied.
What is the impact of CVE-2026-56321?
The impact of CVE-2026-56321 allows unauthenticated requests to access sensitive data via the GET /private/role_bindings endpoint.
Which endpoints are affected by CVE-2026-56321?
CVE-2026-56321 affects the GET /private/role_bindings/:org_id endpoint, which lacks proper authentication.
Who is affected by CVE-2026-56321?
Users of Capgo versions prior to 12.128.2 are affected by CVE-2026-56321 due to missing authentication middleware.