PT-2026-54034 · Cap Go · Cap-Go
CVSS v4.0
6.9
Medium
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Capgo versions prior to 12.128.2
Description
An information disclosure issue exists in the
public.invite user to org RPC function. Unauthenticated attackers can use a publishable API key to call this SECURITY DEFINER function and enumerate the existence of organizations. By observing the difference between NO ORG and NO RIGHTS error responses, an attacker can determine if a specific organization ID exists, facilitating tenant enumeration attacks.Recommendations
Update to version 12.128.2 or later.
Exploit
Fix
Side Channel Attack
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Cap-Go