CVE-2026-56279 Capgo - Information Disclosure via get_orgs_v7 RPC Endpoint
Unauthenticated attackers can retrieve sensitive organization and billing data for arbitrary users via an exposed RPC endpoint in Capgo.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-56279?
CVE-2026-56279 is a high-severity missing authorization vulnerability in Capgo, published on 10 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Capgo before 12.128.2 contains an information disclosure vulnerability in the get_orgs_v7(userid) RPC function that remains publicly invokable despite intended private access controls. Unauthenticated attackers can supply arbitrary user UUIDs to retrieve foreign users' organization membership, roles, management emails, and billing metadata.
Weakness: CWE-862
Which versions are affected by CVE-2026-56279?
How do I fix CVE-2026-56279?
No fix has been published for CVE-2026-56279 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-56279 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-56279 exists.
Sources
Also known as GHSA-f8rq-8r29-248p, GHSA-fch8-pp28-mw2x.