CVE-2026-56323: Capgo Information Disclosure – Unauthenticated API Enumeration Vulnerability

Technical summary

The vulnerability stems from improper access controls on the /functions/v1/channel_self endpoint in Capgo. The endpoint accepts GET requests with arbitrary app_id parameters and returns sensitive metadata including internal rollout channels, application identifiers, and subscription status—all without requiring authentication or device binding validation. The flaw enables enumeration attacks across tenant boundaries, allowing unauthenticated remote attackers to systematically discover valid applications and extract billing intelligence from the API surface.

Business impact

This disclosure exposes your application inventory and customer billing status to competitors and malicious actors. An attacker gains tactical intelligence about which apps you operate, their rollout strategy, and which customers have active subscriptions—information typically reserved for internal use and authorized personnel. In regulated industries, uncontrolled exposure of billing and subscription data may trigger compliance violations. The reconnaissance value is significant: attackers use this information to refine targeting, identify high-value customers, or plan supply-chain attacks.

Affected systems

Capgo deployments running versions earlier than 12.128.2 are vulnerable. All instances hosting the /functions/v1/channel_self endpoint without the patched code are at risk. If you use Capgo for app distribution, rollout management, or channel orchestration, verify your version immediately.

Exploitability

Exploitability is very high. No authentication, special privileges, or user interaction is required—an attacker simply sends HTTP GET requests with varying app_id parameters from the public internet. The attack is scriptable, repeatable, and leaves minimal traces in typical API logs if not specifically monitoring for enumeration patterns. The barrier to exploitation is near zero, making this a prime target for automated reconnaissance scanning.

Remediation

Upgrade Capgo to version 12.128.2 or later without delay. The patch implements proper authentication and authorization checks on the vulnerable endpoint, ensuring only authenticated and authorized callers can access channel and subscription metadata. Apply the patch across all production and staging environments where Capgo is deployed. After patching, review recent API access logs to identify whether the endpoint was queried by unauthorized parties during the vulnerability window.

Patch guidance

Contact Capgo support or consult the official vendor advisory for version 12.128.2 availability and deployment instructions. Verify that your deployment platform (SaaS, on-premises, containerized, or otherwise) receives the patched version and that no cached or older instances remain active. Test the patch in a non-production environment first to ensure compatibility with your application and channel configuration. Plan a coordinated rollout to minimize service interruption if necessary.

Detection guidance

Monitor for repeated GET requests to /functions/v1/channel_self with varying or invalid app_id parameters, especially from external sources. Baseline normal API traffic and alert on anomalous enumeration patterns—sequential app_id scanning, requests from unfamiliar IP ranges, or high request rates to this endpoint. Examine API access logs and CDN/WAF logs for the pre-patch window (from deployment until patch application) to identify whether the endpoint was exploited. Implement rate limiting and request validation on API endpoints to hinder future enumeration attacks.

Why prioritize this

This vulnerability merits immediate remediation. The CVSS 7.5 (HIGH) score reflects the complete confidentiality impact—attackers gain unfettered access to sensitive operational and billing data without authentication. The lack of any access controls and the ease of exploitation make this attractive to both automated scanners and targeted reconnaissance campaigns. While integrity and availability are not directly affected, the intelligence disclosed facilitates downstream attacks and competitive harm.

Risk score, explained

The severity is driven by a perfect storm of factors: unrestricted network access (AV:N), low complexity (AC:L), no authentication (PR:N), no user interaction (UI:N), and complete information disclosure (C:H). The impact is confined to confidentiality—no system integrity or availability compromise—but the breadth of data exposed (application inventory, billing status, internal channels) and the ease of exploitation elevate the risk to HIGH. Organizations should treat this as a critical information governance incident requiring immediate attention.

Frequently asked questions