CVE-2026-56339

The record

Capgo (Cap-go/capgo) before 12.128.2 contains an information disclosure vulnerability in the Supabase PostgREST SECURITY DEFINER RPC function public.rescind_invitation that allows unauthenticated attackers to enumerate organization existence. The function returns distinct error messages (NO_ORG vs NO_RIGHTS) when called with only a publishable API key, enabling attackers to discover valid organization IDs and increase the attack surface for targeted phishing or social engineering campaigns.

Affected packages

Related vulnerabilities

• CVE-2026-65626 The pure-Erlang RSAES-PKCS1-v1_5 decryption in the jose_jwa_pkcs1 module is a… CWE-203
• CVE-2026-76406 In Splunk SOAR versions below 8.7.0, an unauthenticated user with access to encrypted… CWE-203
• CVE-2026-114064 Snipe-IT before 8.7.0 contains a server-side request forgery vulnerability in the webhook… CWE-203
• CVE-2026-111933 Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before… CWE-203
• CVE-2026-18560 Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <=… CWE-203
• CVE-2026-97782 Observable discrepancy in Microsoft Office SharePoint allows an authorized attacker to… CWE-203
• CVE-2026-88834 A flaw was found in BusyBox's httpd web server. CWE-203
• CVE-2026-63573 Observable discrepancy in the CMS RSA PKCS#1 v1.5 key-transport unwrap… CWE-203