CVE-2026-56300

HIGH 7.5

Capgo - Unauthenticated API Key Validity and Permission Oracle via RPC Functions

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

Capgo before 12.128.2 contains unauthenticated security definer RPC functions get_user_id and get_org_perm_for_apikey that expose API key validity oracles and user UUID disclosure. Unauthenticated attackers using the public API key can validate leaked keys, enumerate users and apps, and determine permission levels, significantly increasing the actionability of compromised credentials.

CWE	CWE-200
Vendor	capgo
Product	capgo
Published	Jun 30, 2026

Stay Ahead of the Next One

Get instant alerts for capgo capgo

Be the first to know when new high vulnerabilities affecting capgo capgo are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

Capgo / Capgo

0 < 12.128.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/Cap-go/capgo/security/advisories/GHSA-7r6g-whg3-5mm4 vulncheck.com: https://www.vulncheck.com/advisories/capgo-unauthenticated-api-key-validity-and-permission-oracle-via-rpc-functions

Credits

🔍 Judel777