CVE-2026-56337 Details
Description
Capgo before 12.128.2 contains an information disclosure vulnerability in the public.exist_app_v2 RPC function that allows unauthenticated attackers to enumerate app_ids by calling POST /rest/v1/rpc/exist_app_v2 with arbitrary appid parameters. Remote attackers can exploit this SECURITY DEFINER function to determine whether specific app_ids exist in the public.apps table, enabling cross-tenant app enumeration and privacy violations.
An information disclosure vulnerability has been identified in Capgo versions prior to 12.128.2. The issue resides in the public.exist_app_v2 RPC function, which is accessible to unauthenticated users. By sending POST requests to /rest/v1/rpc/exist_app_v2 with arbitrary app_id parameters, attackers can enumerate app_ids in the public.apps table. This vulnerability, which bypasses row-level security, enables cross-tenant app enumeration and privacy violations.
Users are advised to remove anonymous access to the exist_app_v2 function and implement authentication and authorization checks. Alternatively, if anonymous access is retained, the function should be modified to return a constant response without signaling app existence, with actual existence checks performed server-side using proper authorization.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 24, 2026CISA-ADP
Assessed Jun 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Cap-go/capgo/security/advisories/GHSA-wjqr-gmx8-jj56 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/Cap-go/capgo/security/advisories/GHSA-wjqr-gmx8-jj56 | [email protected] | AdvisoryExploitRemedyVendor |
| https://www.vulncheck.com/advisories/capgo-information-disclosure-via-unauthenticated-rpc-function-exist-app-v2 | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Capgo | < 12.128.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 24, 2026 | New CVE Received | [email protected] |
| Jun 24, 2026 | CVE Modified | CISA-ADP |