Information Disclosure Vulnerability in Capgo Product by Capgo

CVE-2026-56339

What is CVE-2026-56339?

An information disclosure vulnerability exists in Capgo's Supabase PostgREST SECURITY DEFINER RPC function 'public.rescind_invitation', allowing unauthenticated attackers to exploit this function. By invoking it with merely a publishable API key, attackers can differentiate between various error responses—'NO_ORG' versus 'NO_RIGHTS'. This discrepancy reveals details about the existence of organizations within the system, which could facilitate further attacks, including phishing and social engineering campaigns targeting those identified organizations.

References