CVE-2026-56300: Capgo Unauthenticated API Key Validation Oracle (CVSS 7.5)

Technical summary

CVE-2026-56300 is a missing authentication vulnerability in Capgo's RPC interface. Two security definer functions fail to enforce authentication checks before exposing sensitive metadata. The functions permit unauthenticated callers to (1) validate API key material against the system, (2) extract user UUIDs and organizational data, and (3) confirm permission scopes tied to those keys. The root cause is insufficient access control on privileged functions; security definer functions should validate caller identity before returning any data. This creates an oracle—an attacker can use the public API to quickly confirm which keys in a breach list are active and what they can access, removing the reconnaissance burden from a follow-up attack.

Business impact

Compromised API keys become immediately actionable without further detection risk. Attackers can validate stolen credentials in bulk, identify high-value targets (users and apps with elevated permissions), and plan targeted attacks with confidence. This amplifies the real-world damage from any credential leak affecting Capgo users. Incident response teams face increased pressure to rotate keys quickly, and organizations relying on Capgo for application deployment or CI/CD integration must assume that any key exposed in a third-party breach is now fully weaponized.

Affected systems

Capgo versions prior to 12.128.2 are affected. The vulnerability impacts all deployments of Capgo that expose the public RPC API, affecting both direct users and any downstream services or integrations that depend on Capgo's authentication model. Users running 12.128.2 or later are not vulnerable.

Exploitability

Exploitability is high. The attack requires no special privileges, no user interaction, and no complex setup—only network access to Capgo's API and knowledge of the two vulnerable function names. An attacker with a single leaked API key or even without credentials can probe the system to enumerate valid keys and users. The barrier to weaponization is exceptionally low, making this a practical risk for any organization that has experienced a credential leak from any source.

Remediation

Upgrade Capgo to version 12.128.2 or later. The patch adds authentication checks to the vulnerable RPC functions, preventing unauthenticated callers from invoking them. Organizations should treat this as urgent: rotate all API keys immediately upon patching, audit logs for any unauthorized calls to get_user_id or get_org_perm_for_apikey, and revoke keys that show signs of external use. If a credential leak is known to have occurred before patching, assume the leaked key has been tested and prioritize it for rotation.

Patch guidance

Apply Capgo version 12.128.2 or later without delay. This is not a minor update; it closes a direct attack vector on credential security. Plan deployment during your normal maintenance window but prioritize it ahead of non-urgent work. After patching, verify that the RPC functions now reject unauthenticated requests by attempting a test call to get_user_id or get_org_perm_for_apikey with no authentication token—the system should return an authentication error. Document the patch date for audit and compliance purposes.

Detection guidance

In logs and security tools, look for repeated calls to get_user_id or get_org_perm_for_apikey from external IPs or unusual API clients, especially in patterns suggesting enumeration (multiple sequential calls with different parameters). If your organization uses API key logging, flag any instance of a known-compromised key being used to call these functions before the patch was applied. Correlation between Capgo API logs and credential leak notifications is critical: any overlap indicates active exploitation.

Why prioritize this

This vulnerability scores HIGH (CVSS 7.5) because it directly amplifies the impact of credential compromise—a common and frequent occurrence. Unlike vulnerabilities requiring multi-step exploitation, this flaw turns a single leaked key into a reconnaissance tool. For any organization handling credentials or running Capgo in production, this is a direct threat that should be patched within days, not weeks. The lack of user interaction, ease of exploitation, and high confidentiality impact make it a top priority for any change control queue.

Risk score, explained

CVSS 7.5 reflects a network-accessible vulnerability with no authentication requirement (PR:N), no user interaction (UI:N), and high confidentiality impact (C:H) but no integrity or availability consequences. The attack complexity is low (AC:L), meaning standard tools and techniques suffice. The scope is unchanged (S:U), so the blast radius is confined to Capgo users. The score does not inflate based on exploit availability or active exploitation, but the practical risk is severe because leaked credentials are common and this flaw makes them immediately dangerous.

Frequently asked questions