CVE-2026-56331 Capgo - Improper Error Handling in Accept Invitation Endpoint via Invalid Magic String
Attackers can trigger server errors on the invitation endpoint to leak internal processing details via improper error handling.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-56331?
CVE-2026-56331 is a medium-severity vulnerability in Capgo, published on 30 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Capgo before 12.128.2 contains improper error handling in the /private/accept_invitation endpoint that returns HTTP 500 instead of safe 4xx errors when magic_invite_string is invalid. Attackers can trigger this vulnerability using only the public key by submitting malformed magic_invite_string values to cause server errors and leak internal processing details.
Weakness: CWE-209
Which versions are affected by CVE-2026-56331?
How do I fix CVE-2026-56331?
No fix has been published for CVE-2026-56331 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-56331 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-56331 exists.
Sources
Also known as GHSA-34p8-fh3m-376x, GHSA-994r-m5r3-f3p9.