Description
Capgo before 12.128.2 contains an information disclosure vulnerability in the get_orgs_v7(userid) RPC function that remains publicly invokable despite intended private access controls. Unauthenticated attackers can supply arbitrary user UUIDs to retrieve foreign users' organization membership, roles, management emails, and billing metadata.
Published: 2026-07-10
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability authentication check that permits anyone to call the get_orgs_v7 RPC function with any returns the target user’s organization membership, roles, management emails, and billing metadata. Because no identity verification is performed, an attacker can read confidential information about any user in the system, effectively exposing organizational structure and financial data.

Affected Systems

All Capgo platform releases prior to version 12.128.2 are affected. The vendor listed is Capgo by Capgo.

Risk and Exploitability

The CVSS score of 8.7 classifies the flaw as high severity, while the EPSS score than 1% indicates a low overall exploitation probability. Nevertheless, the endpoint is publicly accessible without authentication, making the attack trivial for attackers who can reach the RPC service. The vulnerability is not included in the CISA KEV catalog.

Generated by OpenCVE AI on July 26, 2026 at 13:44 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Capgo to version 12.128.2 or later.
  • Configure the get_orgs_v7 endpoint to require authentication and restrict access to trusted internal networks or an API gateway.
  • Implement rate limiting or request throttling on the RPC service to reduce the impact of repeated exploitation attempts while awaiting the patch.

Generated by OpenCVE AI on July 26, 2026 at 13:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 13 Jul 2026 15:00:00 +0000

Type Values Removed Values Added
First Time appeared Cap-go
Cap-go cap-go
Vendors & Products Cap-go
Cap-go cap-go

Sun, 12 Jul 2026 03:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 10 Jul 2026 14:45:00 +0000

Type Values Removed Values Added
Description Capgo before 12.128.2 contains an information disclosure vulnerability in the get_orgs_v7(userid) RPC function that remains publicly invokable despite intended private access controls. Unauthenticated attackers can supply arbitrary user UUIDs to retrieve foreign users' organization membership, roles, management emails, and billing metadata.
Title Capgo - Information Disclosure via get_orgs_v7 RPC Endpoint
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Cap-go Cap-go
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-07-10T14:44:47.363Z

Reserved: 2026-06-20T01:51:24.919Z

Link: CVE-2026-56279

cve-icon Vulnrichment

Updated: 2026-07-10T14:44:42.524Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-26T13:45:03Z

Weaknesses