Executive brief
Capgo, a platform for managing app updates, contained a security flaw that allowed unauthorized individuals to verify the existence of specific organization accounts. By sending specially crafted requests to a public interface, an attacker could distinguish between valid and invalid organization IDs based on the error messages returned. This information could be used to identify targets for phishing or more sophisticated social engineering attacks against specific companies using the service.
Technical details
An observable discrepancy vulnerability (CWE-203) exists in the Supabase PostgREST RPC function 'public.rescind_invitation'. The function is defined as SECURITY DEFINER and is granted execution permissions to unauthenticated ('anon') users. When queried with only a publishable API key, the function returns 'NO_ORG' for non-existent organization IDs and 'NO_RIGHTS' for valid ones. This allows a remote, unauthenticated attacker to perform a side-channel attack to enumerate valid UUIDs for organizations within the platform. The issue was resolved in version 12.128.2 by normalizing error responses and restricting function access.
Affected products
- Cap-go capgo before 12.128.2
Timeline
- 2026-03-17: advisory: Initial GitHub security advisory published
- 2026-07-15: disclosed: CVE published to NVD dataset