What’s Vulnerable › Vulnerabilities

CVE-2026-56311: Capgo - Unauthenticated Cross-Tenant Disclosure via get_current_plan_max_org RPC

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-22 · updated 2026-06-23
• Weakness: CWE-285

Description

Capgo before 12.128.2 contains an authorization bypass vulnerability in the public.get_current_plan_max_org RPC function that allows unauthenticated attackers to retrieve arbitrary organization plan limits. Attackers can call the RPC endpoint with any organization UUID using only the public Supabase key to disclose billing information including MAU, bandwidth, storage, and build time limits for any organization.

Affected products

• Capgo: before 12.128.2 — fixed in 12.128.2

How to fix

Upgrade to a fixed version: Capgo 12.128.2. Check the vendor advisory for mitigations.

References

• https://github.com/Cap-go/capgo/security/advisories/GHSA-v3jp-r95g-x4mm
• https://www.vulncheck.com/advisories/capgo-unauthenticated-cross-tenant-disclosure-via-get-current-plan-max-org-rpc
• https://github.com/Cap-go/capgo/security/advisories/GHSA-v3jp-r95g-x4mm

Get alerted when CVE-2026-56311 or the next vulnerability affects your stack