CVE-2026-56226

Name of the Vulnerable Software and Affected Versions Capgo versions prior to 12.128.2

Description The software exposes the Supabase PostgREST RPC function public.get orgs v6(userid uuid), which is configured as SECURITY DEFINER and granted to the anon role, enabling unauthenticated access. The function fails to verify if the caller-supplied userid matches the authenticated user. An attacker with a public publishable API key can query the endpoint "POST /rest/v1/rpc/get orgs v6" using an arbitrary user UUID to retrieve sensitive personally identifiable information (PII), including organization membership, roles, subscription or trial metadata, and the management email.

Recommendations Update to version 12.128.2 or later. Restrict access to the public.get orgs v6() function to prevent unauthenticated queries.