CVE-2026-56242 Capgo - Unauthenticated API Key Validity Oracle and User Identity Disclosure via get_identity_apikey_only RPC
Unauthenticated attackers can validate API keys and disclose user identities via an exposed RPC function, potentially leading to further data exposure.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-56242?
CVE-2026-56242 is a high-severity vulnerability in Capgo, published on 21 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Capgo before 12.128.2 contains an unauthenticated security definer RPC function get_identity_apikey_only that returns the owning user_id for supplied API keys, creating an API key validity oracle and user identity disclosure primitive. Attackers can call this endpoint with valid or invalid API keys to confirm key validity and map keys to user identifiers, then chain results into other exposed RPCs like get_orgs_v6 to retrieve organization membership and management email PII.
Weakness: CWE-200
Which versions are affected by CVE-2026-56242?
How do I fix CVE-2026-56242?
No fix has been published for CVE-2026-56242 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-56242 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-56242 exists.
Sources
Also known as GHSA-fhgj-7376-qxwx, GHSA-wc33-3x6m-7v3x.