NULL-Auth Bypass Vulnerability in Capgo by Capgo

CVE-2026-56219

What is CVE-2026-56219?

Capgo, prior to version 12.128.2, has a vulnerability in the public.get_org_user_access_rbac function that allows attackers to bypass authentication. This flaw can be exploited by unauthenticated users to access sensitive RBAC role bindings and retrieve member email addresses. The vulnerability arises from improper handling of NULL in the authorization logic, which permits unauthorized access through the PostgREST RPC endpoint using only a public API key, leading to potential exposure of organization membership details and roles.

References