The vulnerability in Capgo (before version 12.128.2) involves the Supabase PostgREST RPC function public.get_orgs_v6(userid uuid), which is SECURITY DEFINER and accessible by the anon role, enabling unauthenticated access. The function accepts a user UUID parameter without verifying that it corresponds to the authenticated user, allowing an attacker with only the public publishable API key to invoke POST /rest/v1/rpc/get_orgs_v6 with arbitrary UUIDs. This leads to unauthorized disclosure of sensitive information including organization membership, roles, subscription and trial metadata, and personally identifiable information such as management_email.

An attacker can retrieve sensitive user information without authentication by exploiting the exposed RPC function. This includes organization membership details, user roles, subscription and trial metadata, and personally identifiable information (PII) such as management_email. The exposure of this data can lead to privacy violations and potential further targeted attacks. The vulnerability has a high severity rating (CVSS 8.7) due to its ease of exploitation and the sensitivity of the data exposed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is indicated, users should monitor the vendor's communications for updates. Until a fix is available, restrict access to the vulnerable RPC function if possible or implement additional access controls to verify user identity before allowing queries. Avoid using the public publishable API key in untrusted environments to limit exposure.