CVE-2026-56300: Capgo - Unauthenticated API Key Validity and Permission Oracle via RPC Functions
Capgo before 12.128.2 contains unauthenticated security definer RPC functions getuserid and getorgpermforapikey that expose API key validity oracles and user UUID disclosure. Unauthenticated attackers using the public API key can validate leaked keys, enumerate users and apps, and determine permission levels, significantly increasing the actionability of compromised credentials.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56300?
CVE-2026-56300 has a severity rating of 8.7, classified as high risk.
How do I fix CVE-2026-56300?
To resolve CVE-2026-56300, upgrade Capgo to version 12.128.2 or later.
What type of vulnerability is CVE-2026-56300?
CVE-2026-56300 is characterized as an information leak vulnerability.
What are the potential risks associated with CVE-2026-56300?
The risks include unauthorized validation of API keys and user UUID disclosure.
Can unauthenticated users exploit CVE-2026-56300?
Yes, unauthenticated attackers can exploit CVE-2026-56300 to enumerate users and applications.