PT-2026-54034 · Cap Go · Cap-Go

Judel777 · Published 2026-06-30 · Updated 2026-06-30 · CVE-2026-56327

NVD

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Capgo before 12.128.2 contains an information disclosure vulnerability in the public.invite user to org RPC function that allows unauthenticated attackers to enumerate organization existence by observing distinct error responses. Attackers can call the SECURITY DEFINER function with a publishable API key to determine if an organization ID exists based on NO ORG versus NO RIGHTS responses, enabling tenant enumeration attacks.

Fix

Side Channel Attack

Weakness Enumeration

CWE-203

Related Identifiers

CVE-2026-56327

Affected Products

Cap-Go

References · 3

• https://github.com/Cap-go/capgo/security/advisories/GHSA-35q8-ghfg-vp6m · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-56327 · Security Note
• https://vulncheck.com/advisories/capgo-unauthenticated-organization-existence-oracle-via-public-invite-user-to-org-rpc · Note