CVE-2026-56300 Capgo - Unauthenticated API Key Validity and Permission Oracle via RPC Functions
Unauthenticated attackers can validate leaked API keys and enumerate user permissions via exposed RPC functions in Capgo.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-56300?
CVE-2026-56300 is a high-severity vulnerability in Capgo, published on 30 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Capgo before 12.128.2 contains unauthenticated security definer RPC functions get_user_id and get_org_perm_for_apikey that expose API key validity oracles and user UUID disclosure. Unauthenticated attackers using the public API key can validate leaked keys, enumerate users and apps, and determine permission levels, significantly increasing the actionability of compromised credentials.
Weakness: CWE-200
Which versions are affected by CVE-2026-56300?
How do I fix CVE-2026-56300?
No fix has been published for CVE-2026-56300 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-56300 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-56300 exists.
Sources
Also known as GHSA-33gg-4g7f-39f7, GHSA-7r6g-whg3-5mm4.