CVE-2026-56319 | Capgo before 12.128.2 contains an information disclosure vul… | CVSS 4.3 MEDIUM

Description

Capgo before 12.128.2 contains an information disclosure vulnerability in the GET /statistics/app/:app_id endpoint that allows app-limited API keys to distinguish existing sibling app IDs through differential error responses. Attackers can enumerate real app IDs outside their allowed scope by observing 500 PGRST116 errors for inaccessible apps versus 401 errors for nonexistent apps, breaking tenant isolation.

Metadata

CVE ID: CVE-2026-56319
State: PUBLISHED
Assigner: VulnCheck
Reserved: 2026-06-20 12:59 UTC
Published: 2026-06-20 15:24 UTC
Last updated: 2026-06-20 15:24 UTC
Primary CWE: CWE-203
Observable Discrepancy
Vendor / Product: Capgo / Capgo
Sources: cve.org · NVD

Severity & Metrics

4.3 MEDIUM CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected products (1)

Vendor	Product	Platform	Versions
Capgo	Capgo	—	0 < 12.128.2, 12.128.2

Weakness (CWE)

CWE	Source	Description
CWE-203	cna	Observable Discrepancy

CVSS scores (2)

Score	Severity	Version	Source	Vector
5.3	MEDIUM	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
4.3	MEDIUM	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References (2)

GHSA Advisory GHSA-73p9-mprg-7r75 https://github.com/Cap-go/capgo/security/advisories/GHSA-73p9-mprg-7r75
VulnCheck Advisory: Capgo - App Existence Oracle via GET /statistics/app/:app_id https://www.vulncheck.com/advisories/capgo-app-existence-oracle-via-get-statistics-app-app-id