EUVD-2026-38167
GHSA-wc33-3x6m-7v3x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDiscover Capgo PostgREST endpoint
-
DeliveryCollect candidate API keys (leaks, guesses)
-
ExploitCall get_identity_apikey_only RPC unauthenticated
-
ExecutionConfirm key validity and map to user_id
-
PersistChain user_id into get_orgs_v6 RPC
-
ImpactHarvest org membership and management emails
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of Capgo before 12.128.2, requiring only network reach to the Capgo PostgREST /rest/v1/rpc/get_identity_apikey_only endpoint and the ability to submit candidate API keys in JSON request bodies. There is no authentication, no user interaction, and no scope/platform restriction; the only practical limiting factor is that PII chaining via get_orgs_v6 requires that RPC to remain exposed in the same deployment, and attackers without any candidate API keys are limited to brute-force key-validity probing rather than direct identity lookup. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N) accurately reflects a network-reachable, unauthenticated, low-complexity confidentiality-only exposure, producing a base score of 8.7, and the vendor/researcher description is consistent with that vector. No EPSS score, KEV listing, or public POC was provided, so exploitation likelihood signals are limited - but the technique is trivially scriptable against a hosted SaaS endpoint and was disclosed by VulnCheck with a detailed advisory, which lowers the effective barrier to weaponization. The Tags field explicitly calls this an Oracle/Information Disclosure issue, and chaining into get_orgs_v6 elevates the practical impact from raw key validation to PII harvesting (management emails, org membership), so this should be treated as a real priority for any Capgo deployment rather than a high-CVSS but low-impact issue. Integrity and availability are correctly scored N because the bug only reads data; the main residual uncertainty is whether self-hosted instances were also patched in 12.128.2 or only the Capgo Cloud backend. |
| Exploit ScenarioDerived | An attacker scripts HTTP POST requests to the public Capgo PostgREST endpoint /rest/v1/rpc/get_identity_apikey_only, submitting either guessed/leaked API keys or keys harvested from public GitHub commits, and observes which requests return a user_id to confirm key validity. Each resolved user_id is then fed into get_orgs_v6 to enumerate organizations and pull management email addresses, producing a targeted phishing list and a verified set of working API keys for downstream abuse. VulnCheck has publicly described the technique in detail, but no public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 22, 2026
Information disclosure in Capgo before 12.128.2 lets remote unauthenticated attackers abuse the security-definer RPC function get_identity_apikey_only to validate arbitrary API keys and map them to owning user_ids. The endpoint functions as an oracle, and results can be chained into other exposed RPCs such as get_orgs_v6 to enumerate organization membership and harvest management email PII. No public exploit identified at time of analysis, though VulnCheck has publicly documented the technique and a vendor patch is available.
RemediationAI
Upgrade Capgo to 12.128.2 or later, which the vendor confirms as the fix release per advisory GHSA-fhgj-7376-qxwx (https://github.com/Cap-go/capgo/security/advisories/GHSA-fhgj-7376-qxwx). If immediate upgrade is not feasible, revoke and rotate all existing Capgo API keys to invalidate any keys that may have been mapped to user_ids, and restrict access to the PostgREST-exposed get_identity_apikey_only and get_orgs_v6 functions either by revoking EXECUTE from the anon/PUBLIC roles in Postgres or by blocking the corresponding /rest/v1/rpc/get_identity_apikey_only and /rest/v1/rpc/get_orgs_v6 paths at an upstream WAF or reverse proxy - note that blocking these endpoints will break any legitimate clients that depend on them, so identify internal callers first. For self-hosted deployments, additionally enforce per-IP rate limiting on the PostgREST endpoint to slow bulk oracle queries while patching, accepting that this only delays rather than prevents disclosure.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Capgo is an open-source live-update and over-the-air deployment platform for Capacitor mobile apps, backed by a Supabase/PostgREST architecture that exposes Postgres functions as HTTP RPC endpoints. The flaw is rooted in CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): the get_identity_apikey_only function was declared SECURITY DEFINER and exposed via PostgREST without an authentication or rate-limiting check, so it executes with the function owner's privileges and returns the user_id associated with any submitted API key. Because the response differs based on key validity and resolves to a stable user identifier, the endpoint becomes both a validity oracle and an identity-mapping primitive, with downstream RPCs like get_orgs_v6 trusting that user_id as authorization context. The affected CPE is cpe:2.3:a:capgo:capgo:*:*:*:*:*:*:*:* in all versions before 12.128.2.
Know when Capgo gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Network-reachable PostgREST RPC callable with no authentication or user interaction; only confidentiality is impacted via API key oracle and PII disclosure, so I:N/A:N.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
Capgo before 12.128.2 contains an unauthenticated security definer RPC function get_identity_apikey_only that returns the owning user_id for supplied API keys, creating an API key validity oracle and user identity disclosure primitive. Attackers can call this endpoint with valid or invalid API keys to confirm key validity and map keys to user identifiers, then chain results into other exposed RPCs like get_orgs_v6 to retrieve organization membership and management email PII.
Executive ViewAI
Capgo users are exposed to an information disclosure vulnerability (CVE-2026-56242, CVSS 8.7) allowing remote attackers to validate API keys and harvest sensitive organizational data, including management email addresses. No public exploit identified at time of analysis, though the attack technique has been documented. This vulnerability could enable social engineering and compromise organizational security controls.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Cross-domain SSO account takeover in Capgo before 12.128.2 allows an attacker with enterprise org admin access and a mal
Authentication bypass in Capgo before 12.128.2 lets remote unauthenticated attackers mint arbitrary API keys by tamperin
Account pre-registration hijack in Capgo before 12.128.2 lets a remote unauthenticated attacker claim an account under a
Authentication bypass in Capgo prior to version 12.128.2 lets attackers defeat email-based OTP verification by tampering
Rate-limit bypass in Capgo versions prior to 12.128.2 lets remote unauthenticated attackers flood the channel_self endpo
Cross-tenant data poisoning in Supabase Capgo before 12.128.2 allows remote unauthenticated attackers to corrupt billing
Server-side privilege escalation in Capgo before 12.128.2 lets authenticated users holding build permissions abuse a pat
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers query the /functions/v1/channel_se
Account takeover in Capgo before 12.128.2 stems from a password-change endpoint that omits current-password validation (
Information disclosure in Capgo (Capacitor live-update/OTA platform) before 12.128.2 lets unauthenticated callers abuse
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers read organization RBAC role bindin
Cross-tenant authorization bypass in Capgo before 12.128.2 lets authenticated users impersonate another tenant's limited
Exploit-DB