Information Disclosure in Capgo API Endpoint

CVE-2026-56319

What is CVE-2026-56319?

Capgo versions prior to 12.128.2 are susceptible to an information disclosure vulnerability via the GET /statistics/app/:app_id endpoint. This flaw enables attackers wielding app-limited API keys to distinguish existing sibling app IDs by analyzing the differential error responses received. Specifically, attackers can identify real app IDs that fall outside their permissible scope based on the types of errors returned: a 500 PGRST116 error indicates an inaccessible app, while a 401 error signifies a nonexistent app. This behavior undermines tenant isolation and could lead to unauthorized access to application data.

References