CVE-2026-56319CWE-203

Capgo - App Existence Oracle via GET /statistics/app/:app_id

Medium · published June 20, 2026

CVSS v4.0
5.3
EPSS
0%
Percentile
22.2
In the wild
Unconfirmed
What it is

Capgo before 12.128.2 contains an information disclosure vulnerability in the GET /statistics/app/:app_id endpoint that allows app-limited API keys to distinguish existing sibling app IDs through differential error responses. Attackers can enumerate real app IDs outside their allowed scope by observing 500 PGRST116 errors for inaccessible apps versus 401 errors for nonexistent apps, breaking tenant isolation.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00306 · 22.2th percentile
Weakness
CWE-203 · Observable Discrepancy
Published
2026-06-20T15:24Z
EPSS history
Timeline
  • 20 JUN 15:24Z
    Capgo - App Existence Oracle via GET /statistics/app/:app_id
    cvelistv5