CVE-2026-56219 Details
Description
Capgo before 12.128.2 contains a NULL-auth bypass vulnerability in the public.get_org_user_access_rbac function that allows unauthenticated attackers to retrieve RBAC role bindings and member email addresses. Attackers can exploit improper NULL comparison in the authorization gate to disclose organization membership, roles, and email addresses via the PostgREST RPC endpoint using only a public API key.
A NULL-authentication bypass vulnerability has been identified in Capgo versions prior to 12.128.2, specifically within the public.get_org_user_access_rbac function. This vulnerability allows unauthenticated attackers to access RBAC role bindings and member email addresses. The issue arises from an improper NULL comparison in the authorization gate, which can be exploited to leak organization membership, roles, and email addresses through the PostgREST RPC endpoint, using only a public API key.
To address this vulnerability, it is recommended to implement NULL-safe comparisons and deny unauthenticated requests. For example, replace 'auth.uid() != p_user_id' with 'auth.uid() IS DISTINCT FROM p_user_id' and guard 'auth.uid() IS NULL' early in the function. Optionally, restrict the execution of the function to authenticated users if public access is not intended.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 30, 2026CISA-ADP
Assessed Jul 1, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Cap-go/capgo/security/advisories/GHSA-vvm7-xhcj-m94h | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/Cap-go/capgo/security/advisories/GHSA-vvm7-xhcj-m94h | [email protected] | AdvisoryExploitRemedyVendor |
| https://www.vulncheck.com/advisories/capgo-unauthenticated-rbac-bindings-and-email-disclosure-via-get-org-user-access-rbac-null-auth-bypass | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Capgo | < 12.128.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 1, 2026 | CVE Modified | CISA-ADP |
| Jun 30, 2026 | New CVE Received | [email protected] |