What’s Vulnerable › Vulnerabilities

CVE-2026-56253: Capgo - Unauthenticated Organization Member Email Disclosure via get_org_members RPC

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-21 · updated 2026-06-23
• Weakness: CWE-284

Description

Capgo before 12.128.2 contains an improper access control vulnerability in the public.get_org_members RPC function that allows unauthenticated attackers to enumerate organization members. Attackers can invoke the endpoint using only the public sb_publishable_* key and an organization UUID to retrieve sensitive member information including email addresses, user IDs, roles, and pending invitations.

Affected products

• Capgo: before 12.128.2 — fixed in 12.128.2

How to fix

Upgrade to a fixed version: Capgo 12.128.2. Check the vendor advisory for mitigations.

References

• https://github.com/Cap-go/capgo/security/advisories/GHSA-x34h-gc65-f6g4
• https://www.vulncheck.com/advisories/capgo-unauthenticated-organization-member-email-disclosure-via-get-org-members-rpc
• https://github.com/Cap-go/capgo/security/advisories/GHSA-x34h-gc65-f6g4

Get alerted when CVE-2026-56253 or the next vulnerability affects your stack