CVE-2026-56242: Capgo Unauthenticated API Key Validity Oracle and User Identity Disclosure

Technical summary

The vulnerability stems from an unauthenticated security definer RPC function named get_identity_apikey_only that accepts API key input and returns the owning user_id. This function serves as an oracle for API key validity and user identity disclosure. The attack chain involves: (1) calling get_identity_apikey_only with candidate API keys to confirm validity and map keys to user_id values, then (2) chaining results into other exposed RPCs such as get_orgs_v6 to extract organization membership and administrative email addresses. The issue is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and requires no privileges or user interaction to exploit.

Business impact

Organizations relying on Capgo are exposed to user identity enumeration and organizational intelligence gathering attacks. Attackers can systematically discover valid API keys, link them to specific user accounts, and pivot to retrieve PII including management email addresses and organization structure. For Capgo customers, this creates a pathway for targeted phishing, account takeover preparation, and supply-chain reconnaissance. The exposure of management contacts and organizational relationships may also facilitate social engineering and pretexting attacks.

Affected systems

Capgo versions prior to 12.128.2 are affected. The vulnerability resides in unauthenticated API endpoints exposed at the platform level, meaning any network-accessible Capgo instance without the patch is vulnerable. Users should verify their Capgo deployment version and confirm whether the vulnerable RPC functions are exposed in their deployment model.

Exploitability

This vulnerability is straightforward to exploit. It requires only network access to the affected Capgo endpoints—no authentication, no special privileges, and no user interaction. An attacker can automate API calls to enumerate valid keys and harvest user identities and organizational data. The attack surface is broad because the functions are unauthenticated, and the information disclosed (user IDs, organization membership, management emails) is operationally valuable for follow-on attacks. The low complexity and high information payoff make this a priority for exploitation.

Remediation

Upgrade Capgo to version 12.128.2 or later. This patch addresses the authentication bypass and likely restricts access to get_identity_apikey_only and related endpoints. As an immediate mitigation while planning upgrades, organizations should review network access controls to limit exposure of Capgo API endpoints to trusted networks only, and monitor logs for suspicious enumeration patterns (repeated API calls with varying key inputs).

Patch guidance

Apply Capgo update 12.128.2 or newer as soon as feasible. Verify the patch through your package manager and Capgo's official release notes. Test the update in a non-production environment to ensure compatibility with your deployment before rolling out broadly. After patching, validate that the get_identity_apikey_only endpoint is no longer accessible without authentication or is removed entirely.

Detection guidance

Monitor for patterns of repeated API calls to get_identity_apikey_only or get_orgs_v6 endpoints, especially from external sources or with varying API key inputs. Elevated call volumes to these endpoints from a single source IP may indicate enumeration activity. Log and alert on any unauthenticated access to these RPC functions. Additionally, review API key audit logs to identify keys that may have been tested or exposed through this oracle.

Why prioritize this

This vulnerability merits immediate attention because it enables unauthenticated, low-friction reconnaissance that directly exposes user identities and organizational structure. The attack requires no privileges, no user interaction, and can be fully automated. When chained with other exposed endpoints, it becomes a stepping stone for more sophisticated attacks. Organizations running Capgo should treat patching as urgent, particularly if their deployment is internet-facing.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects high confidentiality impact (user IDs, emails, organization data disclosed), low complexity to exploit (unauthenticated, network-accessible), and no requirement for user interaction. The vulnerability does not enable data modification or availability impact, hence the absence of integrity or availability components in the vector. The score appropriately captures the risk of systematic identity and organizational intelligence gathering.

Frequently asked questions