VULNERABILITY INTELLIGENCE
CVE-2026-56279
CVSS score8.7 HIGH
EPSS probability0.43%
CISA KEVNot currently listed
Published2026-07-10
Last modified2026-07-10
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Description
Capgo before 12.128.2 contains an information disclosure vulnerability in the get_orgs_v7(userid) RPC function that remains publicly invokable despite intended private access controls. Unauthenticated attackers can supply arbitrary user UUIDs to retrieve foreign users' organization membership, roles, management emails, and billing metadata.
Weakness classification
- CWE-862: Missing Authorization