CVE-2026-56327 Capgo - Unauthenticated Organization Existence Oracle via public.invite_user_to_org RPC
Unauthenticated attackers can enumerate existing organization IDs by observing distinct error responses from the invite_user_to_org RPC function.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-56327?
CVE-2026-56327 is a medium-severity vulnerability in Capgo, published on 30 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Capgo before 12.128.2 contains an information disclosure vulnerability in the public.invite_user_to_org RPC function that allows unauthenticated attackers to enumerate organization existence by observing distinct error responses. Attackers can call the SECURITY DEFINER function with a publishable API key to determine if an organization ID exists based on NO_ORG versus NO_RIGHTS responses, enabling tenant enumeration attacks.
Weakness: CWE-203
Which versions are affected by CVE-2026-56327?
How do I fix CVE-2026-56327?
No fix has been published for CVE-2026-56327 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-56327 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-56327 exists.
Sources
Also known as GHSA-35q8-ghfg-vp6m, GHSA-443m-f58x-jx9j.