VULNERABILITY INTELLIGENCE

CVE-2026-56253

CVSS score8.7 HIGH
EPSS probability0.42%
CISA KEVNot currently listed
Published2026-06-21
Last modified2026-06-23
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Description

Capgo before 12.128.2 contains an improper access control vulnerability in the public.get_org_members RPC function that allows unauthenticated attackers to enumerate organization members. Attackers can invoke the endpoint using only the public sb_publishable_* key and an organization UUID to retrieve sensitive member information including email addresses, user IDs, roles, and pending invitations.

Weakness classification

  • CWE-284: Improper Access Control

Primary references