Information Disclosure Vulnerability in Capgo by Capgo

CVE-2026-56279

What is CVE-2026-56279?

Capgo before version 12.128.2 is vulnerable to an information disclosure issue in the get_orgs_v7(userid) RPC function, which is publicly accessible despite intended safeguards. This flaw allows unauthenticated attackers to exploit arbitrary user UUIDs, enabling them to fetch sensitive information including foreign users' organization memberships, roles, management emails, and billing metadata, ultimately compromising the confidentiality of user data.

References