Executive brief
Capgo, a platform for managing app updates and configurations, contained a security flaw that allowed unauthorized individuals to access sensitive organization data. By exploiting a bug in how the system verifies user identity, an attacker could view member email addresses and internal role assignments using only a public API key. This information could be used to facilitate targeted phishing attacks or map out a company's internal structure.
Technical details
A NULL-auth bypass vulnerability exists in the 'public.get_org_user_access_rbac' function within Capgo's RBAC system. The root cause is an improper NULL comparison in the PL/pgSQL authorization gate; specifically, when a request is unauthenticated, 'auth.uid()' returns NULL, causing the inequality check 'auth.uid() != p_user_id' to evaluate to NULL and skip the security exception. An unauthenticated attacker can exploit this via the PostgREST RPC endpoint using only a public Supabase publishable key. Successful exploitation allows the disclosure of organization membership, user roles, and member email addresses. The issue is fixed in version 12.128.2 by implementing NULL-safe comparisons (IS DISTINCT FROM) and explicit NULL checks.
Affected products
- Capgo Capgo < 12.128.2
Timeline
- 2026-03-17: advisory: Vendor advisory published on GitHub
- 2026-06-30: disclosed: NVD publication date