Capgo - App Existence Oracle via GET /statistics/app/:app_id

Capgo before 12.128.2 contains an information disclosure vulnerability in the GET /statistics/app/:app_id endpoint that allows app-limited API keys to distinguish existing sibling app IDs through differential error responses. Attackers can enumerate real app IDs outside their allowed scope by observing 500 PGRST116 errors for inaccessible apps versus 401 errors for nonexistent apps, breaking tenant isolation.

Problem type

Observable Discrepancy

Affected products

Capgo

Capgo

< 12.128.2 - AFFECTED

12.128.2 - UNAFFECTED

References

GHSA Advisory GHSA-73p9-mprg-7r75

https://github.com/Cap-go/capgo/security/advisories/GHSA-73p9-mprg-7r75

vendor-advisory

VulnCheck Advisory: Capgo - App Existence Oracle via GET /statistics/app/:app_id

https://www.vulncheck.com/advisories/capgo-app-existence-oracle-via-get-statistics-app-app-id

third-party-advisory

JSON source

https://cveawg.mitre.org/api/cve/CVE-2026-56319

Click to expand

{
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "cveMetadata": {
    "cveId": "CVE-2026-56319",
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "dateUpdated": "2026-06-20T15:24:48.150Z",
    "dateReserved": "2026-06-20T12:59:07.917Z",
    "datePublished": "2026-06-20T15:24:48.150Z",
    "state": "PUBLISHED"
  },
  "containers": {
    "cna": {
      "providerMetadata": {
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck",
        "dateUpdated": "2026-06-20T15:24:48.150Z"
      },
      "datePublic": "2026-05-07T00:00:00.000Z",
      "title": "Capgo - App Existence Oracle via GET /statistics/app/:app_id",
      "descriptions": [
        {
          "lang": "en",
          "value": "Capgo before 12.128.2 contains an information disclosure vulnerability in the GET /statistics/app/:app_id endpoint that allows app-limited API keys to distinguish existing sibling app IDs through differential error responses. Attackers can enumerate real app IDs outside their allowed scope by observing 500 PGRST116 errors for inaccessible apps versus 401 errors for nonexistent apps, breaking tenant isolation."
        }
      ],
      "affected": [
        {
          "vendor": "Capgo",
          "product": "Capgo",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "12.128.2"
            },
            {
              "version": "12.128.2",
              "status": "unaffected",
              "versionType": "semver"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "lang": "en",
              "description": "Observable Discrepancy",
              "cweId": "CWE-203",
              "type": "CWE"
            }
          ]
        }
      ],
      "references": [
        {
          "url": "https://github.com/Cap-go/capgo/security/advisories/GHSA-73p9-mprg-7r75",
          "name": "GHSA Advisory GHSA-73p9-mprg-7r75",
          "tags": [
            "vendor-advisory"
          ]
        },
        {
          "url": "https://www.vulncheck.com/advisories/capgo-app-existence-oracle-via-get-statistics-app-app-id",
          "name": "VulnCheck Advisory: Capgo - App Existence Oracle via GET /statistics/app/:app_id",
          "tags": [
            "third-party-advisory"
          ]
        }
      ],
      "metrics": [
        {
          "format": "CVSS"
        },
        {
          "format": "CVSS",
          "cvssV3_1": {
            "version": "3.1",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "attackVector": "NETWORK",
            "attackComplexity": "LOW",
            "privilegesRequired": "LOW",
            "userInteraction": "NONE",
            "scope": "UNCHANGED",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM"
          }
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Judel777",
          "type": "reporter"
        }
      ]
    }
  }
}