An information disclosure vulnerability exists in Capgo prior to version 12.128.2 within the get_orgs_v7(userid) RPC function. The function does not enforce intended private access controls, remaining publicly invokable. This allows unauthenticated attackers to query arbitrary user UUIDs and obtain foreign users' organization membership details, roles, management contact emails, and billing metadata. The vulnerability is classified under CWE-862 (Missing Authorization). No patch or remediation details are provided in the available data.

Unauthenticated attackers can access sensitive organizational data of other users, including membership, roles, management emails, and billing metadata. This exposure can lead to privacy violations and potential misuse of disclosed information. There is no indication of remote code execution or system compromise, but the confidentiality of user and organizational data is compromised.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the get_orgs_v7(userid) RPC function to authorized users only, for example by implementing network-level access controls or authentication proxies. Monitor for any updates from the vendor regarding patches or official mitigations.