CVE-2026-56337: Capgo - Information Disclosure via Unauthenticated RPC Function exist_app_v2
Capgo before 12.128.2 contains an information disclosure vulnerability in the public.existappv2 RPC function that allows unauthenticated attackers to enumerate appids by calling POST /rest/v1/rpc/existappv2 with arbitrary appid parameters. Remote attackers can exploit this SECURITY DEFINER function to determine whether specific appids exist in the public.apps table, enabling cross-tenant app enumeration and privacy violations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Capgoto a version that resolves this vulnerability.Fixed in 12.128.2 - Compensating control
Restrict network access to the Capgo REST endpoint POST /rest/v1/rpc/exist_app_v2 (public.exist_app_v2 RPC function) so that unauthenticated callers cannot reach it until the fix in 12.128.2 is applied.
Event History
Frequently Asked Questions
What is CVE-2026-56337?
CVE-2026-56337 is an information disclosure vulnerability in Capgo that allows unauthenticated attackers to enumerate app_ids via the public.exist_app_v2 RPC function.
What is the severity of CVE-2026-56337?
The severity of CVE-2026-56337 is categorized as medium with a score of 5.3.
How do I fix CVE-2026-56337?
To fix CVE-2026-56337, update Capgo to version 12.128.2 or later where this vulnerability is addressed.
Who is affected by CVE-2026-56337?
Any users of Capgo versions prior to 12.128.2 are affected by CVE-2026-56337.
What can attackers do with CVE-2026-56337?
Attackers can exploit CVE-2026-56337 to enumerate app_ids without authentication by sending crafted requests to the exist_app_v2 function.