Capgo Unauthenticated Organization Data Disclosure Vulnerability

A vulnerability in Capgo versions prior to 12.128.2 allows unauthenticated access to sensitive organization data through the Supabase PostgREST RPC function public.get_orgs_v6. This function, which is SECURITY DEFINER and granted to the anon role, accepts a caller-supplied user UUID without verification. An attacker can use the public publishable API key to query the function and retrieve information about a user's organization membership, roles, subscription or trial metadata, and management email, which is considered personally identifiable information (PII).

Impact

Exploitation of this vulnerability leads to unauthorized access to sensitive organization data, including PII such as management email addresses, and allows for enumeration of organization membership and roles for any supplied user UUID.

Reproduction

To reproduce this vulnerability, use the public publishable API key to send a POST request to the /rest/v1/rpc/get_orgs_v6 endpoint. Include an arbitrary user UUID in the request data. The response will contain the organization information for the specified user, including roles, subscription details, and management email.

Remediation

To address this vulnerability, remove anon access to the public.get_orgs_v6 function and implement verification to ensure that the supplied user UUID matches the authenticated user. Consider removing management email from the response unless absolutely necessary.