MEDIUM

CVE-2026-56337

2026-06-24 CVSS v3.1

CVSS

5.3

Description

Capgo before 12.128.2 contains an information disclosure vulnerability in the public.exist_app_v2 RPC function that allows unauthenticated attackers to enumerate app_ids by calling POST /rest/v1/rpc/exist_app_v2 with arbitrary appid parameters. Remote attackers can exploit this SECURITY DEFINER function to determine whether specific app_ids exist in the public.apps table, enabling cross-tenant app enumeration and privacy violations.

Summary dbcve.org

Capgo before 12.128.2 has an information disclosure vulnerability in the public.exist_app_v2 RPC function. Unauthenticated attackers can call POST /rest/v1/rpc/exist_app_v2 with arbitrary appid parameters to enumerate whether specific app_ids exist in the public.apps table. As a SECURITY DEFINER function, it allows cross-tenant app enumeration without authentication, enabling privacy violations.

Mitigation

Upgrade to Capgo version 12.128.2 or later. If immediate upgrade is not possible, restrict access to the exist_app_v2 RPC function and implement proper authentication and authorization checks.

Weakness (CWE)

CWE-200 Information Exposure

EPSS Score

0.44%

Probability of exploitation in next 30 days

37.4th percentile

References

https://github.com/Cap-go/capgo/security/advisories/GHSA-wjqr-gmx8-jj56 https://www.vulncheck.com/advisories/capgo-information-disclosure-via-unauthenticated-rpc-function-exist-app-v2

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE