Technical impact
The vulnerability exists in the public.rescind_invitation RPC function defined with SECURITY DEFINER in Capgo's Supabase PostgREST back‑end. An attacker who provides only a publishable API key can invoke the function and receive distinct error messages – NO_ORG when an organization ID does not exist and NO_RIGHTS when the key lacks sufficient rights. This difference enables confirmation of valid organization IDs, revealing internal structure without authentication, which could be used for targeted phishing or social engineering. The weakness is an information‑exposure flaw (CWE‑203).
Affected Systems
Capgo (Cap-go/capgo) installations that expose the public.rescind_invitation RPC function are vulnerable. Versions prior to 12.128.2 are potentially affected; newer releases may have remedied the issue but this cannot be confirmed from the available data.
Risk and Exploitability
The CVSS score of 8.7 indicates high severity for information disclosure. The EPSS score is below 1 percent, suggesting low current exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog, so there are no known active exploits. Attackers can trigger the flaw by sending unauthenticated requests to the RPC endpoint with a publishable API key, which is typically available without further authentication. Based on these metrics, the vulnerability represents a significant risk to confidentiality and should be addressed promptly, although the probability of widespread exploitation remains low.
