CVE-2026-56339: Capgo - Unauthenticated Organization Existence Enumeration via rescind_invitation RPC
Capgo (Cap-go/capgo) before 12.128.2 contains an information disclosure vulnerability in the Supabase PostgREST SECURITY DEFINER RPC function public.rescindinvitation that allows unauthenticated attackers to enumerate organization existence. The function returns distinct error messages (NOORG vs NORIGHTS) when called with only a publishable API key, enabling attackers to discover valid organization IDs and increase the attack surface for targeted phishing or social engineering campaigns.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Capgo (Cap-go/capgo)to a version that resolves this vulnerability.Fixed in 12.128.2 - Compensating control
Mitigate unauthenticated enumeration risk by preventing access to the public.rescind_invitation Supabase PostgREST SECURITY DEFINER RPC function from unauthenticated callers (e.g., block/limit exposure at network/route level) until the Capgo update to 12.128.2 is applied.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56339?
The severity of CVE-2026-56339 is rated high with a score of 8.7.
How do I fix CVE-2026-56339?
To fix CVE-2026-56339, upgrade Capgo to version 12.128.2 or later.
What type of vulnerability is CVE-2026-56339?
CVE-2026-56339 is an information disclosure vulnerability.
What can attackers achieve with CVE-2026-56339?
Attackers can enumerate the existence of organizations without authentication using CVE-2026-56339.
Which function is affected by CVE-2026-56339?
The affected function in CVE-2026-56339 is the public.rescind_invitation RPC function.