Capgo before 12.128.2 contains an information disclosure flaw in the GET /statistics/app/:app_id endpoint. When an app‑limited API key is used, the server replies with different error codes based on the target app ID: a 500 error (PGRST116) indicates that the app exists but is out of the key's scope, while a 401 error signals that the app does not exist. Because of this differential response, an attacker can enumerate valid app IDs that belong to other tenants, effectively breaking tenant isolation and exposing internal identifiers.

All deployments of Capgo with a server version earlier than 12.128.2 are vulnerable. The issue manifests in the public statistics route and can be triggered by any authenticated user possessing an app‑limited API key. The product vendor is Capgo.

The CVSS base score of 5.3 classifies the flaw as a medium‑severity information‑disclosure vulnerability. No EPSS score is available, and the flaw is not listed in the CISA KEV catalog. The attack vector is a remote, network‑based HTTP GET request to the statistics endpoint; an attacker only needs a legitimate API key scoped to a single tenant. By observing the differing error responses, enumeration of all sibling app IDs can be performed. This can give an attacker knowledge of the tenant’s internal resource identifiers, potentially leading to further attacks if additional privileged actions are available.