Attack Chain

1. An attacker identifies a Capgo instance running a vulnerable version (prior to 12.128.2).
2. The attacker obtains the Capgo application's publicly available API key, typically found in client-side code or network traffic.
3. The attacker crafts a malicious HTTP POST request targeting the exposed Supabase PostgREST RPC endpoint: /rest/v1/rpc/get_orgs_v6.
4. Within the request body, the attacker includes a JSON payload containing an arbitrary userid UUID belonging to a user within the Capgo system.
5. The vulnerable Capgo application, due to the anon role grant and SECURITY DEFINER setting for public.get_orgs_v6, processes the unauthenticated request.
6. The RPC function executes, querying the backend Supabase database using the attacker-supplied userid UUID.
7. The database returns all associated user details to the Capgo application.
8. The Capgo application then sends the sensitive data, including organization membership, roles, subscription/trial metadata, and management_email, back to the attacker in the API response.

Impact

The successful exploitation of CVE-2026-56226 leads to unauthorized retrieval of sensitive user data. Attackers can obtain organization membership details, assigned roles, subscription and trial status, and critical Personally Identifiable Information (PII) such as the management_email for any user whose UUID they can guess or enumerate. This direct access to user data without authentication poses a severe privacy risk and can be leveraged for further social engineering, targeted phishing, or identity theft. The scope of impact is potentially all users registered on a vulnerable Capgo instance.

Recommendation

• Patch CVE-2026-56226 immediately by updating Capgo to version 12.128.2 or later.
• Deploy the Sigma rule "Detects CVE-2026-56226 Exploitation - Unauthenticated Capgo Data Retrieval" to your SIEM to identify attempts to exploit this vulnerability.
• Review webserver access logs for the specific cs-uri-stem /rest/v1/rpc/get_orgs_v6 for successful POST requests (sc-status: 200) from untrusted IP addresses or sources indicating potential exploitation.