CyberRota Analysis
AI-GeneratedAn information disclosure vulnerability exists in Capgo versions prior to 12.128.2, allowing unauthenticated attackers to exploit the get_orgs_v7(userid) RPC function, which should be restricted to private access. This flaw enables attackers to retrieve sensitive data, including organization membership, roles, management emails, and billing information of other users by supplying arbitrary user UUIDs. Organizations using affected versions should prioritize patching to mitigate the risk of unauthorized data exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Capgo before 12.128.2 contains an information disclosure vulnerability in the get_orgs_v7(userid) RPC function that remains publicly invokable despite intended private access controls. Unauthenticated attackers can supply arbitrary user UUIDs to retrieve foreign users' organization membership, roles, management emails, and billing metadata.