PT-2026-54032 · Cap Go · Cap-Go

Judel777 · Published 2026-06-30 · Updated 2026-06-30 · CVE-2026-56318

Mitre

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Capgo before 12.128.2 contains an information disclosure vulnerability in the /private/validate password compliance endpoint that returns different error responses for malformed, non-existent, and existing organization IDs. Unauthenticated attackers can enumerate valid organization UUIDs by observing response status codes and error messages, allowing confirmation of organization existence.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-56318

Affected Products

Cap-Go

References · 3

• https://github.com/Cap-go/capgo/security/advisories/GHSA-fwwh-rqv7-6pjf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-56318 · Security Note
• https://vulncheck.com/advisories/capgo-information-disclosure-via-private-validate-password-compliance-endpoint · Note