Capgo - Unauthenticated Channel Enumeration and App Oracle via GET /channel_self

Capgo before 12.128.2 contains an information disclosure vulnerability in the /functions/v1/channel_self endpoint that allows unauthenticated attackers to enumerate non-public channel names and determine app existence and subscription status. Remote attackers can send GET requests with arbitrary app_id parameters to disclose internal rollout channels, enumerate valid applications across tenants, and leak billing status without authentication or device binding.

Problem type

Exposure of Sensitive Information to an Unauthorized Actor

Affected products

Capgo

Capgo

< 12.128.2 - AFFECTED

12.128.2 - UNAFFECTED

References

GitHub Security Advisory (GHSA-469v-6vw5-hxpq)

https://github.com/Cap-go/capgo/security/advisories/GHSA-469v-6vw5-hxpq

vendor-advisory

VulnCheck Advisory: Capgo - Unauthenticated Channel Enumeration and App Oracle via GET /channel_self

https://www.vulncheck.com/advisories/capgo-unauthenticated-channel-enumeration-and-app-oracle-via-get-channel-self

third-party-advisory

JSON source

https://cveawg.mitre.org/api/cve/CVE-2026-56323

Click to expand

{
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "cveMetadata": {
    "cveId": "CVE-2026-56323",
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "dateUpdated": "2026-06-22T21:04:49.612Z",
    "dateReserved": "2026-06-20T13:06:29.993Z",
    "datePublished": "2026-06-22T21:04:49.612Z",
    "state": "PUBLISHED"
  },
  "containers": {
    "cna": {
      "providerMetadata": {
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck",
        "dateUpdated": "2026-06-22T21:04:49.612Z"
      },
      "datePublic": "2026-02-10T00:00:00.000Z",
      "title": "Capgo - Unauthenticated Channel Enumeration and App Oracle via GET /channel_self",
      "descriptions": [
        {
          "lang": "en",
          "value": "Capgo before 12.128.2 contains an information disclosure vulnerability in the /functions/v1/channel_self endpoint that allows unauthenticated attackers to enumerate non-public channel names and determine app existence and subscription status. Remote attackers can send GET requests with arbitrary app_id parameters to disclose internal rollout channels, enumerate valid applications across tenants, and leak billing status without authentication or device binding."
        }
      ],
      "affected": [
        {
          "vendor": "Capgo",
          "product": "Capgo",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "12.128.2"
            },
            {
              "version": "12.128.2",
              "status": "unaffected",
              "versionType": "semver"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "lang": "en",
              "description": "Exposure of Sensitive Information to an Unauthorized Actor",
              "cweId": "CWE-200",
              "type": "CWE"
            }
          ]
        }
      ],
      "references": [
        {
          "url": "https://github.com/Cap-go/capgo/security/advisories/GHSA-469v-6vw5-hxpq",
          "name": "GitHub Security Advisory (GHSA-469v-6vw5-hxpq)",
          "tags": [
            "vendor-advisory"
          ]
        },
        {
          "url": "https://www.vulncheck.com/advisories/capgo-unauthenticated-channel-enumeration-and-app-oracle-via-get-channel-self",
          "name": "VulnCheck Advisory: Capgo - Unauthenticated Channel Enumeration and App Oracle via GET /channel_self",
          "tags": [
            "third-party-advisory"
          ]
        }
      ],
      "metrics": [
        {
          "format": "CVSS"
        },
        {
          "format": "CVSS",
          "cvssV3_1": {
            "version": "3.1",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "attackVector": "NETWORK",
            "attackComplexity": "LOW",
            "privilegesRequired": "NONE",
            "userInteraction": "NONE",
            "scope": "UNCHANGED",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH"
          }
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Judel777",
          "type": "reporter"
        }
      ]
    }
  }
}