PT-2026-54032 · Cap Go · Cap-Go

Judel777 · Publicado 2026-06-30 · Atualizado 2026-06-30 · CVE-2026-56318

Mitre

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Capgo before 12.128.2 contains an information disclosure vulnerability in the /private/validate password compliance endpoint that returns different error responses for malformed, non-existent, and existing organization IDs. Unauthenticated attackers can enumerate valid organization UUIDs by observing response status codes and error messages, allowing confirmation of organization existence.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2026-56318

Produtos afetados

Cap-Go

Referências · 3

• https://github.com/Cap-go/capgo/security/advisories/GHSA-fwwh-rqv7-6pjf · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-56318 · Nota de Segurança
• https://vulncheck.com/advisories/capgo-information-disclosure-via-private-validate-password-compliance-endpoint · Nota