CVE-2026-56331: Capgo - Improper Error Handling in Accept Invitation Endpoint via Invalid Magic String
Capgo before 12.128.2 contains improper error handling in the /private/acceptinvitation endpoint that returns HTTP 500 instead of safe 4xx errors when magicinvitestring is invalid. Attackers can trigger this vulnerability using only the public key by submitting malformed magicinvitestring values to cause server errors and leak internal processing details.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56331?
CVE-2026-56331 has a medium severity rating of 6.9.
How do I fix CVE-2026-56331?
To fix CVE-2026-56331, update your Capgo software to version 12.128.2 or later which addresses the error handling issue.
What type of systems are affected by CVE-2026-56331?
CVE-2026-56331 affects Capgo software versions prior to 12.128.2.
What does CVE-2026-56331 exploit?
CVE-2026-56331 exploits improper error handling in the /private/accept_invitation endpoint when an invalid magic_invite_string is provided.
What are the potential risks associated with CVE-2026-56331?
Exploiting CVE-2026-56331 can lead to information leakage through HTTP 500 errors, which may inadvertently reveal sensitive system details.