CVE-2026-56214 Details
Description
Capgo before 12.128.2 contains an information disclosure vulnerability in Supabase PostgREST RPC endpoints is_trial_org and is_paying_org that allows unauthenticated attackers to enumerate organizations and disclose billing status using the public sb_publishable key. Attackers can invoke these endpoints to determine organization existence via distinguishable return values and identify paying customers for targeted profiling.
An information disclosure vulnerability has been identified in Capgo versions prior to 12.128.2. This vulnerability exists in Supabase PostgREST RPC endpoints 'is_trial_org' and 'is_paying_org'. It allows unauthenticated attackers to enumerate organizations and disclose billing statuses using the public 'sb_publishable' key. Exploitation of this vulnerability enables attackers to determine the existence of organizations through distinct return values and to identify paying customers for targeted profiling.
Users are advised to update to Capgo version 12.128.2 or later. For versions prior to 12.128.2, restrict the 'is_trial_org' and 'is_paying_org' RPCs to authenticated contexts and validate organization membership. Alternatively, ensure these endpoints are only callable with privileged or service credentials.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 20, 2026CISA-ADP
Assessed Jun 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Cap-go/capgo/security/advisories/GHSA-mh5p-rrhp-442q | CISA-ADP | AdvisoryExploitRemedyTechnical DescriptionVendor |
| https://github.com/Cap-go/capgo/security/advisories/GHSA-mh5p-rrhp-442q | [email protected] | AdvisoryExploitRemedyTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/capgo-unauthenticated-organization-enumeration-and-billing-status-disclosure-via-supabase-rpc | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Capgo | < 12.128.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 22, 2026 | CVE Modified | CISA-ADP |
| Jun 20, 2026 | New CVE Received | [email protected] |