Capgo CVE-2026-56303

Exploitation requires the Capgo PostgREST endpoint /rest/v1/rpc/find_apikey_by_value to be network-reachable and the find_apikey_by_value function to retain its default SECURITY DEFINER definition with EXECUTE granted to the anon role (the vulnerable state in versions before 12.128.2). Per the CVSS vector no authentication or user interaction is needed (PR:N/UI:N). The key practical limiter is that the attacker must supply a valid API key value to obtain metadata for it - the function returns data keyed on a known value rather than enumerating all keys - so impact hinges on the attacker first acquiring or guessing a legitimate key; deployments already upgraded to 12.128.2, or that have revoked anon EXECUTE on the function, are not exploitable.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) reflects a straightforward, network-reachable, unauthenticated call with high confidentiality impact and no integrity or availability effect, yielding a High score of 8.7. A meaningful real-world limiter that the raw score understates is that the function requires the attacker to already supply a valid key value to return metadata for it, so this is more a metadata-amplification/confirmation primitive than a bulk-dump of all keys - useful once a key is guessed, leaked, or otherwise obtained. There is no EPSS score, no SSVC decision, and no KEV or POC signal in the provided data, so exploitation probability cannot be quantified; the absence of exploitation signals means priority should be driven by whether an organization actually runs Capgo self-hosted with the vulnerable function exposed. Net: a genuine unauthenticated exposure worth patching promptly for Capgo operators, but not a mass-exploitation event on current evidence.

An attacker who has obtained a Capgo API key value - through a leaked mobile app bundle, log exposure, or a prior breach - sends an unauthenticated POST to /rest/v1/rpc/find_apikey_by_value with that value and receives the key's user_id, mode, org scope, and expiration. This confirms the key is valid and reveals which organization and privilege mode it grants, letting the attacker prioritize and target follow-on abuse. No public exploit identified at time of analysis, but the call is a trivial single HTTP request given the low attack complexity.