Executive brief
Capgo, a platform for managing app updates, contained a flaw that allowed unauthorized individuals to verify the existence of specific organizations on the platform. By sending specially crafted requests to a public invitation function, an attacker could distinguish between valid and invalid organization IDs based on the error messages returned. This could be used to map out customer lists or target specific tenants for further attacks.
Technical details
An observable discrepancy vulnerability (CWE-203) exists in the 'public.invite_user_to_org' RPC function within Capgo's Supabase-based backend. The function is defined as SECURITY DEFINER and is granted public access via the 'anon' role, allowing it to be called with a publishable API key. An unauthenticated attacker can supply arbitrary UUIDs to the 'org_id' parameter; the system returns 'NO_ORG' for non-existent IDs and 'NO_RIGHTS' for valid IDs. This side-channel allows for reliable tenant enumeration. The issue was addressed in version 12.128.2 by restricting access and potentially unifying error responses.
Affected products
- Capgo Capgo before 12.128.2
Timeline
- 2026-03-17: advisory: GitHub Security Advisory published
- 2026-06-30: disclosed: NVD publication date