Description
Capgo before 12.128.2 contains an information disclosure vulnerability in the get_orgs_v7(userid) RPC function that remains publicly invokable despite intended private access controls. Unauthenticated attackers can supply arbitrary user UUIDs to retrieve foreign users' organization membership, roles, management emails, and billing metadata.
Published: 2026-07-10
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a missing authentication flaw (CWE-862) that allows any party to call the get_orgs_v7 RPC endpoint with an arbitrary user UUID. Because no identity verification is performed, unauthenticated attackers receive detailed membership, role, management email, and billing information for any user in the system. This enables the exposure of confidential organizational structure and financial data.

Affected Systems

Capgo releases prior to version 12.128.2 are affected. The vendor is Capgo by Capgo.

Risk and Exploitability

The CVSS score of 8.7 indicates high severity, while the EPSS score below 1% signals a low overall exploitation probability. Nevertheless, the endpoint is publicly reachable without authentication, making exploitation trivial for anyone who can reach the RPC service. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit it by sending a request to the get_orgs_v7 RPC with any user UUID parameter. No additional privileges or credentials are required.

Generated by OpenCVE AI on July 31, 2026 at 13:04 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Capgo to version 12.128.2 or later.
  • Configure the get_orgs_v7 endpoint to require authentication and restrict access to trusted internal networks or an API gateway.
  • Implement rate limiting or request throttling on the RPC service to reduce the impact of repeated exploitation attempts while awaiting the patch.

Generated by OpenCVE AI on July 31, 2026 at 13:04 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 13 Jul 2026 15:00:00 +0000

Type Values Removed Values Added
First Time appeared Cap-go
Cap-go cap-go
Vendors & Products Cap-go
Cap-go cap-go

Sun, 12 Jul 2026 03:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 10 Jul 2026 14:45:00 +0000

Type Values Removed Values Added
Description Capgo before 12.128.2 contains an information disclosure vulnerability in the get_orgs_v7(userid) RPC function that remains publicly invokable despite intended private access controls. Unauthenticated attackers can supply arbitrary user UUIDs to retrieve foreign users' organization membership, roles, management emails, and billing metadata.
Title Capgo - Information Disclosure via get_orgs_v7 RPC Endpoint
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Cap-go Cap-go
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-07-10T14:44:47.363Z

Reserved: 2026-06-20T01:51:24.919Z

Link: CVE-2026-56279

cve-icon Vulnrichment

Updated: 2026-07-10T14:44:42.524Z

cve-icon NVD

Status : Deferred

Published: 2026-07-10T15:16:42.157

Modified: 2026-07-10T16:16:33.963

Link: CVE-2026-56279

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T13:15:03Z

Weaknesses