Capgo versions prior to 12.128.2 expose sensitive PostgreSQL replication telemetry through the unauthenticated /replication endpoint. The vulnerability allows an attacker to retrieve details such as replication slot names, confirmed_flush_lsn, restart_lsn, and database error messages, which can facilitate reconnaissance of the underlying database infrastructure. This can lead to knowledge of internal configurations that may be leveraged in future attacks, compromising the confidentiality of system data.

The affected system is Capgo, a platform for real‑time data synchronization. Versions older than 12.128.2 are vulnerable. No specific minor patch releases are listed in the CNA data, but any release after 12.128.2 is considered safe.

The CVSS score of 6.9 indicates a medium severity vulnerability. The EPSS score is not available, so the probability of exploitation remains uncertain, and the issue is not currently tracked in CISA KEV. Attackers can reach the vulnerable endpoint without authentication, making it easily exploitable in scenarios where the network perimeter allows such traffic. The immediate risk is the inadvertent disclosure of replication telemetry, potentially aiding attackers in mapping the backend database architecture.