CVE-2026-56242 Overview
CVE-2026-56242 affects Capgo versions prior to 12.128.2. The application exposes an unauthenticated security definer Remote Procedure Call (RPC) function named get_identity_apikey_only that returns the owning user_id for any supplied API key. This behavior creates an API key validity oracle and a user identity disclosure primitive. Attackers can query the endpoint with arbitrary API keys to confirm key validity and map keys to user identifiers. The disclosed identifiers can then be chained into other exposed RPCs such as get_orgs_v6 to retrieve organization membership and management email Personally Identifiable Information (PII). The flaw is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.
Critical Impact
Unauthenticated network attackers can validate stolen API keys, enumerate user identities, and pivot to disclose organization membership and management email PII.
Affected Products
- Capgo versions prior to 12.128.2
- Deployments exposing the get_identity_apikey_only RPC function
- Capgo instances with the chained get_orgs_v6 RPC reachable without authentication
Discovery Timeline
- 2026-06-21 - CVE-2026-56242 published to the National Vulnerability Database (NVD)
- 2026-06-22 - Last updated in NVD database
Technical Details for CVE-2026-56242
Vulnerability Analysis
The vulnerability resides in the get_identity_apikey_only RPC function, which is defined as a security definer routine and exposed without authentication. Security definer functions execute with the privileges of the function owner rather than the caller, bypassing standard row-level security controls. When invoked, the function accepts an API key argument and returns the associated user_id if the key is valid. An unauthenticated attacker can submit arbitrary keys and observe the response to distinguish valid keys from invalid ones, building a reliable oracle for credential validation and user enumeration.
Root Cause
The root cause is missing authentication and missing authorization checks on a security definer RPC that returns sensitive identity data. The function trusts any caller to supply an API key and discloses the owning principal, conflating key validation with public lookup functionality. No rate limiting, caller verification, or constant-time response handling is applied.
Attack Vector
The attack vector is network-based and requires no privileges or user interaction. An attacker sends crafted RPC requests directly to the Capgo backend invoking get_identity_apikey_only with target API keys. Valid keys yield a user_id, invalid keys yield a null or empty response. The attacker then calls get_orgs_v6 with discovered identifiers to enumerate organization membership and harvest management email addresses. The technique enables large-scale key brute-forcing, credential stuffing validation, and targeted PII collection without authentication.
No verified exploitation code is published. Refer to the GitHub Security Advisory GHSA-fhgj-7376-qxwx and the VulnCheck Security Advisory for upstream technical details.
Detection Methods for CVE-2026-56242
Indicators of Compromise
- Repeated unauthenticated RPC calls to get_identity_apikey_only from a single source or distributed sources
- High volume of failed key lookups followed by successful lookups against get_orgs_v6
- Sequential or dictionary-pattern API key values supplied to RPC endpoints
- Anomalous spikes in user_id to organization resolution requests
Detection Strategies
- Inspect backend logs for invocations of get_identity_apikey_only lacking an authenticated session context
- Correlate calls to get_identity_apikey_only with subsequent get_orgs_v6 calls within short time windows
- Baseline RPC traffic per source IP and alert on deviations consistent with enumeration
Monitoring Recommendations
- Enable verbose audit logging on all security definer RPC functions and forward to a centralized analytics platform
- Add Web Application Firewall (WAF) rules to flag unauthenticated POST traffic to RPC endpoints exposing identity data
- Monitor for outbound emails or downstream notifications referencing newly enumerated management addresses
How to Mitigate CVE-2026-56242
Immediate Actions Required
- Upgrade Capgo to version 12.128.2 or later as published in the vendor advisory
- Rotate all API keys that may have been validated against the vulnerable endpoint
- Audit recent RPC logs for unauthenticated invocations of get_identity_apikey_only and get_orgs_v6
- Restrict network exposure of Capgo RPC endpoints to authenticated callers only
Patch Information
The fix is included in Capgo 12.128.2. The patched release removes unauthenticated access to the affected security definer function and restricts identity lookups to authorized callers. Patch details are documented in the GitHub Security Advisory GHSA-fhgj-7376-qxwx.
Workarounds
- Revoke or drop the get_identity_apikey_only RPC function if upgrade cannot be applied immediately
- Apply database-level access controls to deny anon and public roles from executing identity RPCs
- Place the Capgo API behind an authenticating reverse proxy or API gateway
- Implement strict rate limiting on RPC endpoints to slow enumeration attempts
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
