CVE-2026-56279

Name of the Vulnerable Software and Affected Versions Capgo versions prior to 12.128.2

Description An information disclosure issue exists in the get orgs v7(userid) RPC function, which remains publicly accessible despite intended private access controls. Unauthenticated attackers can provide arbitrary user UUIDs via the userid variable to retrieve sensitive data of other users, including organization membership, roles, management emails, and billing metadata.

Recommendations Update to version 12.128.2 or later. As a temporary mitigation, restrict access to the get orgs v7(userid) function.