CVE-2026-56318CWE-200

Capgo - Information Disclosure via /private/validate_password_compliance Endpoint

Medium · published June 30, 2026

CVSS v4.0
6.9
EPSS
0%
Percentile
28.4
In the wild
Unconfirmed
What it is

Capgo before 12.128.2 contains an information disclosure vulnerability in the /private/validate_password_compliance endpoint that returns different error responses for malformed, non-existent, and existing organization IDs. Unauthenticated attackers can enumerate valid organization UUIDs by observing response status codes and error messages, allowing confirmation of organization existence.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00358 · 28.4th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2026-06-30T22:08Z
EPSS history
Timeline
  • 30 JUN 22:08Z
    Capgo - Information Disclosure via /private/validate_password_compliance Endpoint
    cvelistv5