EUVD-2026-43232
GHSA-g3p6-j9ww-hmwc
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable unauthenticated endpoint (AV:N, PR:N, AC:L), no scope change, low confidentiality impact only - leaks internal IDs, no integrity or availability effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Capgo before 12.128.2 contains an information disclosure vulnerability in the unauthenticated /private/sso/check-domain endpoint that returns internal org_id and provider_id values. Attackers can enumerate email domains to build mappings of domains to organization UUIDs and SSO provider identifiers, enabling reconnaissance against Capgo tenants.
AnalysisAI
Unauthenticated information disclosure in Capgo's /private/sso/check-domain endpoint exposes internal org_id and provider_id values to any network-reachable attacker. All Capgo deployments prior to version 12.128.2 are affected, with the vulnerable endpoint accessible without credentials. An attacker can systematically enumerate email domains against this endpoint to construct a detailed mapping of domains to organization UUIDs and SSO provider identifiers, enabling targeted reconnaissance against Capgo tenants - no public exploit identified at time of analysis.
Technical ContextAI
Capgo is a live-update delivery platform for Capacitor-based mobile applications. The affected component is the /private/sso/check-domain endpoint, which appears to serve SSO configuration lookup functionality but is improperly exposed without authentication controls. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) applies directly: the endpoint returns org_id (organization UUID) and provider_id (SSO provider identifier) values that are intended for internal use. These internal identifiers, while not credentials themselves, constitute sensitive organizational metadata. The CPE string cpe:2.3:a:capgo:capgo:*:*:*:*:*:*:*:* covers all Capgo versions prior to the fix. The root cause is a missing authentication gate on an endpoint that handles organization-level SSO configuration data.
RemediationAI
Vendor-released patch: Capgo 12.128.2. Upgrade to 12.128.2 or any later release, following the guidance in the GitHub security advisory at https://github.com/Cap-go/capgo/security/advisories/GHSA-c5jf-5wxg-mgrq. If immediate upgrade is not possible, a compensating control is to restrict network access to the /private/sso/check-domain endpoint via WAF rules, reverse proxy ACLs, or firewall policy - blocking unauthenticated external access to this specific path eliminates exposure without disabling SSO functionality for authenticated users. Note that blocking at the network layer requires care not to interfere with legitimate SSO domain-check flows if those are initiated externally. Adding an authentication requirement or rate-limiting to the endpoint at the application layer is a secondary mitigation if infrastructure-level blocking is not feasible.
Authentication bypass in Capgo before 12.128.2 lets remote unauthenticated attackers mint arbitrary API keys by tamperin
Cross-domain SSO account takeover in Capgo before 12.128.2 allows an attacker with enterprise org admin access and a mal
Account pre-registration hijack in Capgo before 12.128.2 lets a remote unauthenticated attacker claim an account under a
Authentication bypass in Capgo prior to version 12.128.2 lets attackers defeat email-based OTP verification by tampering
Rate-limit bypass in Capgo versions prior to 12.128.2 lets remote unauthenticated attackers flood the channel_self endpo
Cross-tenant data poisoning in Supabase Capgo before 12.128.2 allows remote unauthenticated attackers to corrupt billing
Server-side privilege escalation in Capgo before 12.128.2 lets authenticated users holding build permissions abuse a pat
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers query the /functions/v1/channel_se
Account takeover in Capgo before 12.128.2 stems from a password-change endpoint that omits current-password validation (
Information disclosure in Capgo (Capacitor live-update/OTA platform) before 12.128.2 lets unauthenticated callers abuse
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers read organization RBAC role bindin
Cross-tenant authorization bypass in Capgo before 12.128.2 lets authenticated users impersonate another tenant's limited
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today