Is CVE-2026-56339 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-56339 being exploited in the wild.

How severe is CVE-2026-56339?

High severity, with a CVSS score of 7.5, published 15 July 2026.

Is there a fix for CVE-2026-56339?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-56339 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-56339?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-56339: Capgo information disclosure via organization enumeration in rescind_invitation RPC

CVE-2026-56339 · Severity: high · CVSS 7.5 · Published 2026-07-15

Capgo, a platform for managing app updates, contained a security flaw that allowed unauthorized individuals to verify the existence of specific organization accounts. By sending specially crafted requests to a public interface, an attacker could distinguish between valid and invalid organization IDs based on the error messages returned. This information could be used to identify targets for phishing or more sophisticated social engineering attacks against specific companies using the service.

Quick answers

Is CVE-2026-56339 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-56339 being exploited in the wild.
How severe is CVE-2026-56339?: High severity, with a CVSS score of 7.5, published 15 July 2026.
Which products and versions are affected?: Cap-go capgo before 12.128.2.
Is there a fix for CVE-2026-56339?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-56339 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-56339?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An observable discrepancy vulnerability (CWE-203) exists in the Supabase PostgREST RPC function 'public.rescind_invitation'. The function is defined as SECURITY DEFINER and is granted execution permissions to unauthenticated ('anon') users. When queried with only a publishable API key, the function returns 'NO_ORG' for non-existent organization IDs and 'NO_RIGHTS' for valid ones. This allows a remote, unauthenticated attacker to perform a side-channel attack to enumerate valid UUIDs for organizations within the platform. The issue was resolved in version 12.128.2 by normalizing error responses and restricting function access.

Affected products

Cap-go capgo before 12.128.2

Timeline

2026-03-17: advisory: Initial GitHub security advisory published
2026-07-15: disclosed: CVE published to NVD dataset

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.