PT-2026-51223 · Cap Go · Cap-Go

Judel777 · Published 2026-06-21 · Updated 2026-06-21 · CVE-2026-56253

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Capgo versions prior to 12.128.2

Description Improper access control in the public.get org members() RPC function allows unauthenticated attackers to enumerate organization members. By using a public sb publishable * key and an organization UUID, attackers can retrieve sensitive member information, including email addresses, user IDs, roles, and pending invitations.

Recommendations Update to version 12.128.2 or later. As a temporary workaround, restrict access to the public.get org members() function to minimize the risk of exploitation.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2026-56253

Affected Products

Cap-Go

References · 4

• https://github.com/Cap-go/capgo/security/advisories/GHSA-x34h-gc65-f6g4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-56253 · Security Note
• https://twitter.com/VulmonFeeds/status/2068769775023444443 · Twitter Post
• https://vulncheck.com/advisories/capgo-unauthenticated-organization-member-email-disclosure-via-get-org-members-rpc · Note