Information Disclosure Vulnerability in Capgo by Capgo

CVE-2026-56303

What is CVE-2026-56303?

An information disclosure vulnerability exists in Capgo versions prior to 12.128.2. The vulnerability lies within the find_apikey_by_value PostgreSQL function, which is marked as SECURITY DEFINER and can be executed by the anonymous user role. This flaw allows unauthenticated attackers to invoke the function via the /rest/v1/rpc/find_apikey_by_value endpoint, potentially revealing sensitive API key metadata such as user IDs, operational modes, organization scope, and expiration details provided a valid key value is supplied. This issue poses significant risks to user privacy and data security.

References