Capgo before version 12.128.2 exposes a public RPC function that accepts POST requests to /rest/v1/rpc/exist_app_v2 without requiring authentication. An attacker can supply arbitrary appid values and learn whether that app_id exists in the public.apps table, enabling enumeration of applications across tenants and violating confidentiality. The weakness is classified as CWE‑200.

Any Capgo deployment running a version older than 12.128.2 is affected. The vulnerability resides in the server component that exposes the exist_app_v2 RPC method and allows unauthenticated callers to query the existence of application identifiers.

The CVSS score of 6.9 indicates moderate risk. Because the exploit requires only remote network access to a publicly exposed RPC endpoint, it is readily exploitable by attackers without credentials. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, but the lack of authentication makes the attack vector straightforward and potentially high‑frequency in practice.