CVE-2026-56219 | Capgo before 12.128.2 contains a NULL-auth bypass vulnerabil… | CVSS 7.5 HIGH

Description

Capgo before 12.128.2 contains a NULL-auth bypass vulnerability in the public.get_org_user_access_rbac function that allows unauthenticated attackers to retrieve RBAC role bindings and member email addresses. Attackers can exploit improper NULL comparison in the authorization gate to disclose organization membership, roles, and email addresses via the PostgREST RPC endpoint using only a public API key.

Metadata

CVE ID: CVE-2026-56219
State: PUBLISHED
Assigner: VulnCheck
Reserved: 2026-06-19 21:43 UTC
Published: 2026-06-30 22:08 UTC
Last updated: 2026-07-01 14:57 UTC
Primary CWE: CWE-287
Improper Authentication
Vendor / Product: Capgo / Capgo
Sources: cve.org · NVD

Severity & Metrics

7.5 HIGH CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: yes
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
Capgo	Capgo	—	0 < 12.128.2, 12.128.2

Weakness (CWE)

CWE	Source	Description
CWE-287	cna	Improper Authentication

CVSS scores (2)

Score	Severity	Version	Source	Vector
8.7	HIGH	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
7.5	HIGH	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References (2)

GitHub Security Advisory (GHSA-vvm7-xhcj-m94h) https://github.com/Cap-go/capgo/security/advisories/GHSA-vvm7-xhcj-m94h
VulnCheck Advisory: Capgo - Unauthenticated RBAC Bindings and Email Disclosure via get_org_user_access_rbac NULL-auth Bypass https://www.vulncheck.com/advisories/capgo-unauthenticated-rbac-bindings-and-email-disclosure-via-get-org-user-access-rbac-null-auth-bypass