CVE-2026-56337: Capgo App ID Enumeration via Unauthenticated RPC Endpoint

Technical summary

The public.exist_app_v2 RPC function in Capgo is marked as a SECURITY DEFINER routine, meaning it executes with elevated privileges. Before version 12.128.2, this function fails to authenticate callers and does not validate or restrict the app_id parameter. An attacker can POST arbitrary appid values to /rest/v1/rpc/exist_app_v2 and receive responses indicating existence or non-existence of entries in the public.apps table. Because the endpoint is network-accessible without credentials, this becomes a straightforward enumeration vector. The vulnerability is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor).

Business impact

Information disclosure of this kind erodes customer trust and can expose competitive intelligence. Organizations using Capgo may not realize their app portfolios are discoverable to competitors or malicious actors. Cross-tenant enumeration is a privacy violation that could trigger compliance concerns under GDPR, CCPA, and similar regulations. While the vulnerability does not allow modification or deletion of data, the reputational and legal implications of user data leakage are significant.

Affected systems

Capgo versions up to and including 12.128.2-1 are affected. The vulnerable code path is the public.exist_app_v2 RPC function exposed via the /rest/v1/rpc/exist_app_v2 POST endpoint. Any deployment running Capgo before the patched version should be considered at risk if that endpoint is internet-facing.

Exploitability

Exploitation is trivial and requires no authentication, special tools, or user interaction. An attacker with network access to the Capgo instance can use curl, Python requests, or any HTTP client to craft POST payloads and probe for app existence. The attack surface is low—no code execution, no complex logic, just repetitive queries. The CVSS score of 5.3 (Medium) reflects low attack complexity and no privileges required, though impact is limited to confidentiality.

Remediation

Upgrade Capgo to version 12.128.2 or later. The patch adds authentication checks and/or parameter validation to the exist_app_v2 RPC function, preventing unauthenticated enumeration. Verify the upgrade in your deployment and confirm the endpoint no longer responds to unauthenticated requests with sensitive information.

Patch guidance

Deploy Capgo 12.128.2 or newer. Check your current version and plan an update as part of your routine patch cycle. If you are running an older version, prioritize this update to restore proper access controls. Coordinate the deployment with your change management process to minimize service disruption.

Detection guidance

Monitor logs for repeated POST requests to /rest/v1/rpc/exist_app_v2 from external sources or unusual patterns of app_id enumeration attempts. Look for HTTP 200 responses that correlate with sequential or systematic app_id patterns. Intrusion detection systems can flag these behaviors as reconnaissance activity. After patching, verify that the endpoint rejects unauthenticated requests or returns consistent responses regardless of app_id validity.

Why prioritize this

Although rated Medium severity, this vulnerability should be prioritized because it is effortless to exploit, requires zero authentication, and enables cross-tenant reconnaissance. Organizations relying on app confidentiality or operating in regulated industries should patch quickly. The flaw is not in the KEV catalog, but its simplicity and information disclosure nature make it attractive for threat actors conducting reconnaissance.

Risk score, explained

CVSS 5.3 reflects the lack of authentication requirements and network accessibility (AV:N, PR:N), low attack complexity (AC:L), and confidentiality impact (C:L). No integrity or availability impact lowers the score. The rating is appropriate for an information disclosure that does not lead to system compromise but does violate privacy and cross-tenant boundaries.

Frequently asked questions