CyberRota Analysis
AI-GeneratedThe vulnerability in Capgo prior to version 12.128.2 allows unauthenticated attackers to exploit the Supabase PostgREST SECURITY DEFINER RPC function, leading to information disclosure about existing organizations. By leveraging distinct error messages, attackers can enumerate valid organization IDs, heightening the risk of targeted phishing or social engineering attacks. Organizations using affected versions should prioritize patching to mitigate this significant security risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Capgo (Cap-go/capgo) before 12.128.2 contains an information disclosure vulnerability in the Supabase PostgREST SECURITY DEFINER RPC function public.rescind_invitation that allows unauthenticated attackers to enumerate organization existence. The function returns distinct error messages (NO_ORG vs NO_RIGHTS) when called with only a publishable API key, enabling attackers to discover valid organization IDs and increase the attack surface for targeted phishing or social engineering campaigns.