PT-2026-51408 · Cap Go · Cap-Go

Judel777 · Published 2026-06-22 · Updated 2026-06-22 · CVE-2026-56311

Mitre

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Capgo before 12.128.2 contains an authorization bypass vulnerability in the public.get current plan max org RPC function that allows unauthenticated attackers to retrieve arbitrary organization plan limits. Attackers can call the RPC endpoint with any organization UUID using only the public Supabase key to disclose billing information including MAU, bandwidth, storage, and build time limits for any organization.

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2026-56311

Affected Products

Cap-Go

References · 3

• https://github.com/Cap-go/capgo/security/advisories/GHSA-v3jp-r95g-x4mm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-56311 · Security Note
• https://vulncheck.com/advisories/capgo-unauthenticated-cross-tenant-disclosure-via-get-current-plan-max-org-rpc · Note