PT-2026-54031 · Cap Go · Cap-Go

Judel777 · Published 2026-06-30 · Updated 2026-06-30 · CVE-2026-56300

NVD

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Capgo before 12.128.2 contains unauthenticated security definer RPC functions get user id and get org perm for apikey that expose API key validity oracles and user UUID disclosure. Unauthenticated attackers using the public API key can validate leaked keys, enumerate users and apps, and determine permission levels, significantly increasing the actionability of compromised credentials.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-56300

Affected Products

Cap-Go

References · 3

• https://github.com/Cap-go/capgo/security/advisories/GHSA-7r6g-whg3-5mm4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-56300 · Security Note
• https://vulncheck.com/advisories/capgo-unauthenticated-api-key-validity-and-permission-oracle-via-rpc-functions · Note