CVE-2026-56219 Capgo - Unauthenticated RBAC Bindings and Email Disclosure via get_org_user_access_rbac NULL-auth Bypass
Unauthenticated attackers can bypass authorization checks to disclose organization member emails and RBAC roles via a public API endpoint.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-56219?
CVE-2026-56219 is a high-severity authentication bypass vulnerability in Capgo, published on 30 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Capgo before 12.128.2 contains a NULL-auth bypass vulnerability in the public.get_org_user_access_rbac function that allows unauthenticated attackers to retrieve RBAC role bindings and member email addresses. Attackers can exploit improper NULL comparison in the authorization gate to disclose organization membership, roles, and email addresses via the PostgREST RPC endpoint using only a public API key.
Weakness: CWE-287
Which versions are affected by CVE-2026-56219?
How do I fix CVE-2026-56219?
No fix has been published for CVE-2026-56219 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-56219 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-56219 exists.
Sources
Also known as GHSA-f484-qgwx-c6gr, GHSA-vvm7-xhcj-m94h.