CVE-2026-56300

Capgo - Unauthenticated API Key Validity and Permission Oracle via RPC Functions

State: Published
Severity: 8.7 High
Published: Jun 30, 2026
Updated: Jul 1, 2026
Reserved: Jun 20, 2026

Description

Capgo before 12.128.2 contains unauthenticated security definer RPC functions get_user_id and get_org_perm_for_apikey that expose API key validity oracles and user UUID disclosure. Unauthenticated attackers using the public API key can validate leaked keys, enumerate users and apps, and determine permission levels, significantly increasing the actionability of compromised credentials.

Scores

CVSS	Score	Vector	Source
4.0	8.7 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N	VulnCheck
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	VulnCheck

Weaknesses

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Affected Products

Product	Versions
CapgoCapgo	before 12.128.2Affected 12.128.2Not affected

References

GitHub Security Advisory (GHSA-7r6g-whg3-5mm4)vendor-advisory
VulnCheck Advisory: Capgo - Unauthenticated API Key Validity and Permission Oracle via RPC Functionsthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.