CVE-2026-56339 describes an information disclosure vulnerability in Capgo's Supabase PostgREST SECURITY DEFINER RPC function public.rescind_invitation. The function returns distinct error messages (NO_ORG vs NO_RIGHTS) when invoked with a publishable API key, enabling unauthenticated attackers to enumerate the existence of organizations. This discrepancy in error responses leaks information about valid organization IDs, increasing the attack surface for social engineering or phishing campaigns. The vulnerability affects versions prior to 12.128.2. No official patch or remediation guidance is currently provided, and no known exploits are reported in the wild.

The vulnerability allows unauthenticated attackers to confirm the existence of organization IDs by analyzing error message differences. This information disclosure can facilitate targeted phishing or social engineering attacks by revealing valid organizational targets. There is no indication of direct system compromise or privilege escalation from this vulnerability alone.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit exposure of the affected RPC function to trusted users or consider implementing additional access controls or monitoring to detect suspicious enumeration attempts.