BaseFortify

Publication date: 2026-06-30

Last updated on: 2026-06-30

Assigner: VulnCheck

Description

Capgo before 12.128.2 contains an information disclosure vulnerability in the public.invite_user_to_org RPC function that allows unauthenticated attackers to enumerate organization existence by observing distinct error responses. Attackers can call the SECURITY DEFINER function with a publishable API key to determine if an organization ID exists based on NO_ORG versus NO_RIGHTS responses, enabling tenant enumeration attacks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-30

Last Modified

2026-06-30

Generated

2026-07-01

AI Q&A

2026-07-01

EPSS Evaluated

N/A

NVD

CVE-2026-56327

EUVD

EUVD-2026-40438

Affected Vendors & Products

Vendor	Product	Version / Range
capgo	capgo	to 12.128.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-203	The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Capgo versions before 12.128.2 in the public.invite_user_to_org RPC function. It allows unauthenticated attackers to determine whether an organization exists by analyzing different error messages returned by the system. Specifically, attackers can use a SECURITY DEFINER function with a publishable API key to distinguish between 'NO_ORG' and 'NO_RIGHTS' responses, enabling them to enumerate tenants or organizations.

Impact Analysis

The vulnerability can lead to information disclosure by allowing attackers to confirm the existence of organizations within the system without authentication. This tenant enumeration can be used as a reconnaissance step for further targeted attacks or exploitation, potentially compromising privacy and security of the affected organizations.

Hi! I’m here to help you understand CVE-2026-56327. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70