PT-2026-51408 · Cap Go · Cap-Go

Judel777 · Publicado 2026-06-22 · Atualizado 2026-06-22 · CVE-2026-56311

Mitre

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Capgo before 12.128.2 contains an authorization bypass vulnerability in the public.get current plan max org RPC function that allows unauthenticated attackers to retrieve arbitrary organization plan limits. Attackers can call the RPC endpoint with any organization UUID using only the public Supabase key to disclose billing information including MAU, bandwidth, storage, and build time limits for any organization.

Correção

Improper Authorization

Enumeração de Fraquezas

CWE-285

Identificadores relacionados

CVE-2026-56311

Produtos afetados

Cap-Go

Referências · 3

• https://vulncheck.com/advisories/capgo-unauthenticated-cross-tenant-disclosure-via-get-current-plan-max-org-rpc · Nota
• https://github.com/Cap-go/capgo/security/advisories/GHSA-v3jp-r95g-x4mm · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-56311 · Nota de Segurança