PT-2026-51221 · Cap Go · Cap-Go

Judel777 · Publicado 2026-06-21 · Atualizado 2026-06-21 · CVE-2026-56242

NVD

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Capgo before 12.128.2 contains an unauthenticated security definer RPC function get identity apikey only that returns the owning user id for supplied API keys, creating an API key validity oracle and user identity disclosure primitive. Attackers can call this endpoint with valid or invalid API keys to confirm key validity and map keys to user identifiers, then chain results into other exposed RPCs like get orgs v6 to retrieve organization membership and management email PII.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2026-56242

Produtos afetados

Cap-Go

Referências · 3

• https://github.com/Cap-go/capgo/security/advisories/GHSA-fhgj-7376-qxwx · Aviso do Fabricante
• https://vulncheck.com/advisories/capgo-unauthenticated-api-key-validity-oracle-and-user-identity-disclosure-via-get-identity-apikey-only-rpc · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-56242 · Nota de Segurança