PT-2026-51223 · Cap Go · Cap-Go

Judel777 · Publicado 2026-06-21 · Atualizado 2026-06-21 · CVE-2026-56253

Mitre

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Capgo before 12.128.2 contains an improper access control vulnerability in the public.get org members RPC function that allows unauthenticated attackers to enumerate organization members. Attackers can invoke the endpoint using only the public sb publishable * key and an organization UUID to retrieve sensitive member information including email addresses, user IDs, roles, and pending invitations.

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

CVE-2026-56253

Produtos afetados

Cap-Go

Referências · 3

• https://github.com/Cap-go/capgo/security/advisories/GHSA-x34h-gc65-f6g4 · Aviso do Fabricante
• https://vulncheck.com/advisories/capgo-unauthenticated-organization-member-email-disclosure-via-get-org-members-rpc · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-56253 · Nota de Segurança