PT-2026-51221 · Cap Go · Cap-Go

Judel777 · Published 2026-06-21 · Updated 2026-06-21 · CVE-2026-56242

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Capgo versions prior to 12.128.2

Description An unauthenticated security definer RPC function get identity apikey only() returns the owning user id for supplied API keys. This creates an API key validity oracle—a mechanism that allows an attacker to determine if a specific key is valid—and a user identity disclosure primitive. Attackers can call this endpoint with various API keys to confirm their validity and map them to user identifiers. These results can then be used with other exposed RPCs, such as get orgs v6(), to retrieve organization membership and management email personally identifiable information (PII).

Recommendations Update to version 12.128.2 or later. As a temporary workaround, restrict access to the get identity apikey only() function.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-56242

Affected Products

Cap-Go

References · 4

• https://github.com/Cap-go/capgo/security/advisories/GHSA-fhgj-7376-qxwx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-56242 · Security Note
• https://vulncheck.com/advisories/capgo-unauthenticated-api-key-validity-oracle-and-user-identity-disclosure-via-get-identity-apikey-only-rpc · Note
• https://twitter.com/VulmonFeeds/status/2068774894834176205 · Twitter Post