CVE-2026-56319

Capgo - App Existence Oracle via GET /statistics/app/:app_id

Published Jun 20, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Description

Capgo before 12.128.2 contains an information disclosure vulnerability in the GET /statistics/app/:app_id endpoint that allows app-limited API keys to distinguish existing sibling app IDs through differential error responses. Attackers can enumerate real app IDs outside their allowed scope by observing 500 PGRST116 errors for inaccessible apps versus 401 errors for nonexistent apps, breaking tenant isolation.

Analysis

Technical impact

Capgo before 12.128.2 contains an information disclosure flaw in the GET /statistics/app/:app_id endpoint. When an app‑limited API key is used, the server replies with different error codes based on the target app ID: a 500 error (PGRST116) indicates that the app exists but is out of the key's scope, while a 401 error signals that the app does not exist. Because of this differential response, an attacker can enumerate valid app IDs that belong to other tenants, effectively breaking tenant isolation and exposing internal identifiers.

Affected Systems

All deployments of Capgo with a server version earlier than 12.128.2 are vulnerable. The issue manifests in the public statistics route and can be triggered by any authenticated user possessing an app‑limited API key. The product vendor is Capgo.

Risk and Exploitability

The CVSS base score of 5.3 classifies the flaw as a medium‑severity information‑disclosure vulnerability. No EPSS score is available, and the flaw is not listed in the CISA KEV catalog. The attack vector is a remote, network‑based HTTP GET request to the statistics endpoint; an attacker only needs a legitimate API key scoped to a single tenant. By observing the differing error responses, enumeration of all sibling app IDs can be performed. This can give an attacker knowledge of the tenant’s internal resource identifiers, potentially leading to further attacks if additional privileged actions are available.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Capgo

unaffected

Version	Status	Constraints
`0`	affected	< 12.128.2
`12.128.2`	unaffected	—

No data.

Vendor Product Versions

Cap-go

Version	Status	Scheme	Platform
`[0,12.128.2)`	affected	semver	—
`12.128.2`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to Capgo 12.128.2 or later, where the endpoint no longer reveals existence information.
Restrict the statistics endpoint so that only administrators or the owning tenant can access it and ensure app‑limited keys receive a uniform error response (e.g., always 404 or 403) regardless of whether the ID exists.
Implement rate limiting or access controls on the GET /statistics/app/:app_id route to reduce enumeration attempts.

Generated by OpenCVE AI on June 20, 2026 at 17:20 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.306% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/Cap-go/capgo/security/advisories/GHSA-73p9-mprg-7r75
https://www.vulncheck.com/advisories/capgo-app-existence-oracle-via-get-statistics-app-app-id

History

Jun 24, 2026 4:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Cap-go Cap-go cap-go
Vendors & Products		Cap-go Cap-go cap-go

Jun 22, 2026 2:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 20, 2026 4:15 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Capgo before 12.128.2 contains an information disclosure vulnerability in the GET /statistics/app/:app_id endpoint that allows app-limited API keys to distinguish existing sibling app IDs through differential error responses. Attackers can enumerate real app IDs outside their allowed scope by observing 500 PGRST116 errors for inaccessible apps versus 401 errors for nonexistent apps, breaking tenant isolation.
Title		Capgo - App Existence Oracle via GET /statistics/app/:app_id
Weaknesses		CWE-203
References		https://github.com/Cap-go/capgo/security/advisories/GHSA-73p9-mprg-7r75 https://www.vulncheck.com/advisories/capgo-app-existence-oracle-via-get-statistics-app-app-id
Metrics		cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}` cvssV4_0 `{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}`