Capgo versions prior to 12.128.2 expose sensitive API‑key metadata through a PostgreSQL function named find_apikey_by_value. The function is declared with SECURITY DEFINER and can be invoked by the anon role, allowing an unauthenticated attacker to call the /rest/v1/rpc/find_apikey_by_value endpoint and retrieve user_id, mode, organization scope, and expiration information. This leads to an information‑disclosure flaw as described by CWE‑200, compromising confidentiality of API‑key data.

Deployments of the Capgo application distributed by Capgo:Capgo are affected. Any installation running a version older than 12.128.2 is vulnerable, regardless of the underlying operating system or PostgreSQL version, unless the RPC endpoint has been otherwise restricted or access has been revoked.

The CVSS score of 8.7 reflects a high severity impact. The EPSS score is below 1 %, indicating a low probability of exploitation but the vulnerability is still reachable via a straightforward HTTP request to the exposed RPC endpoint. The vulnerability is not included in the CISA KEV catalog, so no publicly known exploits are documented. Attackers do not require authentication or elevated privileges, making the attack path trivial from untrusted networks.