Capgo before version 12.128.2 exposes the PostgREST RPC function public.get_orgs_v6, which is defined with SECURITY DEFINER privilege and granted to the anon role. The function accepts a caller-supplied UUID without verifying that it matches the authenticated user. This constitutes a CWE-200: Information Exposure weakness. An attacker who only has the public publishable API key can therefore issue a POST request to /rest/v1/rpc/get_orgs_v6 with any UUID, causing the server to return that user's organization membership, roles, subscription/trial metadata, and the management_email address. This leakage provides personally identifiable information that should be kept confidential.

Any Capgo deployment running a version earlier than 12.128.2 is affected. The flaw resides in the server-side RPC layer and does not depend on client configuration. Public publishable API keys used by applications are sufficient for an attacker to trigger the disclosure.

The CVSS score of 8.7 places the issue in the high severity range, and because only a public API key is required, the practical barrier to an exploit is low. The EPSS score is reported as <1% (approximately 0.00255), indicating that while current exploitation probability is low, this does not preclude future attacks. The vulnerability is not listed in the CISA KEV catalog, but the ease of exploitation and the sensitive data exposed make it a significant risk that should be addressed promptly.