PT-2026-60114 · Cap Go+1 · Cap-Go+1
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Capgo versions prior to 12.128.2
Description
An information disclosure issue exists in the Supabase PostgREST SECURITY DEFINER RPC function
public.rescind invitation(). Unauthenticated attackers using only a publishable API key can enumerate the existence of organizations. This is possible because the function returns distinct error messages, specifically NO ORG and NO RIGHTS, allowing attackers to identify valid organization IDs. This discovery can be used to facilitate targeted phishing or social engineering campaigns.Recommendations
Update to version 12.128.2 or later.
Exploit
Fix
Side Channel Attack
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Cap-Go
Postgres