PT-2026-57169 · Cap Go · Cap-Go

Judel777 · Publicado 2026-07-10 · Atualizado 2026-07-10 · CVE-2026-56279

NVD

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Capgo before 12.128.2 contains an information disclosure vulnerability in the get orgs v7(userid) RPC function that remains publicly invokable despite intended private access controls. Unauthenticated attackers can supply arbitrary user UUIDs to retrieve foreign users' organization membership, roles, management emails, and billing metadata.

Exploit

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-56279

Produtos afetados

Cap-Go

Referências · 3

• 🔥 https://github.com/Cap-go/capgo/security/advisories/GHSA-fch8-pp28-mw2x · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-56279 · Nota de Segurança
• https://vulncheck.com/advisories/capgo-information-disclosure-via-get-orgs-v7-rpc-endpoint · Nota