CVE-2026-56339 Cap-go CVE debrief

Who should care

Defenders responsible for Capgo deployments, security teams, and administrators of affected systems should assess their exposure and implement compensating controls. Defenders should prioritize verifying the presence of this vulnerability in their Capgo deployments and assess the exposure of their organization IDs.

Why it matters

CVE-2026-56339 is an information disclosure vulnerability in Capgo that allows unauthenticated attackers to enumerate organization existence, increasing the attack surface for targeted phishing or social engineering campaigns. Defenders should prioritize verifying the presence of this vulnerability in their Capgo deployments and assess the exposure of their organization IDs.

• Enumeration of organization IDs increases the attack surface for targeted phishing or social engineering campaigns
• Unauthenticated attackers can exploit this vulnerability to discover valid organization IDs
• Defenders need to verify the presence of this vulnerability in their Capgo deployments and assess exposure
• Remediation priority is high due to the potential for exploitation

Technical summary

The Supabase PostgREST SECURITY DEFINER RPC function public.rescind_invitation in Capgo before 12.128.2 returns distinct error messages when called with a publishable API key, allowing attackers to discover valid organization IDs. This vulnerability allows unauthenticated attackers to enumerate organization existence, increasing the attack surface for targeted phishing or social engineering campaigns. The function returns distinct error messages (NO_ORG vs NO_RIGHTS) when called with only a publishable API key, enabling attackers to discover valid organization IDs and increase the attack surface for targeted phishing or social engineering campaigns.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their Capgo deployments and assess the exposure of their organization IDs.

Recommended defensive actions

• Verify the presence of this vulnerability in Capgo deployments
• Assess the exposure of organization IDs
• Implement compensating controls to prevent enumeration
• Monitor for potential phishing or social engineering campaigns
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details about the vulnerability, including its description and CVSS score. However, the exact affected and fixed versions of Capgo require verification from the official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.