CVE-2026-56300: Capgo Information Disclosure Vulnerability

CVE-2026-56300 Overview

CVE-2026-56300 affects Capgo versions before 12.128.2. The application exposes two unauthenticated security definer Remote Procedure Call (RPC) functions, get_user_id and get_org_perm_for_apikey, that leak sensitive information. Unauthenticated attackers using the public API key can validate leaked API keys, enumerate users and applications, and determine permission levels associated with credentials.

The flaw is classified as an information exposure weakness [CWE-200]. It significantly increases the actionability of any leaked or previously compromised Capgo credentials by giving attackers a validity oracle before they attempt further abuse.

Critical Impact
Attackers can validate stolen API keys and enumerate user UUIDs without authentication, turning previously unusable credential leaks into confirmed access vectors.

Affected Products

Capgo versions prior to 12.128.2
Deployments exposing the get_user_id RPC function
Deployments exposing the get_org_perm_for_apikey RPC function

Discovery Timeline

2026-06-30 - CVE-2026-56300 published to the National Vulnerability Database (NVD)
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-56300

Vulnerability Analysis

Capgo exposes PostgreSQL RPC functions through its Supabase-style API layer. Two of these functions, get_user_id and get_org_perm_for_apikey, are declared with SECURITY DEFINER privileges and lack authentication requirements. Any client presenting the public anonymous API key can invoke them directly.

The get_user_id function accepts input that maps to internal user identifiers. Attackers can iterate inputs to enumerate valid user UUIDs across the tenant. The get_org_perm_for_apikey function accepts an API key value and returns the organization-level permissions associated with it.

Together, the two functions form an information disclosure primitive that transforms an unauthenticated attacker into an informed adversary. This weakness maps to [CWE-200: Exposure of Sensitive Information to an Unauthorized Actor].

Root Cause

The root cause is missing authorization on SECURITY DEFINER RPC functions. Functions defined with elevated privileges must enforce access control checks internally, but these functions rely only on the presence of a public API key. The public key is intended for anonymous frontend usage and does not represent an authenticated principal.

Attack Vector

Exploitation is fully remote and requires no user interaction. An attacker sends HTTPS requests to the RPC endpoint with the public anon API key. Calling get_org_perm_for_apikey with a candidate API key value returns either a permission object (confirming validity) or a null response (indicating invalidity).

The attacker uses this behavior as a validity oracle for credential stuffing against previously leaked Capgo API keys. Successful lookups reveal the associated organization permission tier, allowing attackers to prioritize high-privilege credentials. Parallel calls to get_user_id enumerate user identifiers for follow-on targeting.

No verified proof-of-concept code has been published. Technical details are available in the GitHub Security Advisory GHSA-7r6g-whg3-5mm4 and the VulnCheck Advisory on Capgo.

Detection Methods for CVE-2026-56300

Indicators of Compromise

High-volume POST requests to /rest/v1/rpc/get_user_id or /rest/v1/rpc/get_org_perm_for_apikey from single source addresses
RPC requests carrying only the public anon API key rather than a user JWT bearer token
Sequential or dictionary-style payloads submitted to these two RPC endpoints within short time windows

Detection Strategies

Alert on request rates to the two RPC endpoints that exceed baseline application usage patterns
Correlate 200 OK responses from get_org_perm_for_apikey with subsequent authenticated API activity from new source addresses
Flag any invocation of these RPC functions in PostgreSQL query logs where the caller role is anon

Monitoring Recommendations

Enable PostgreSQL function-level auditing for all SECURITY DEFINER routines and forward logs to a centralized data lake
Track API key usage counts per key and alert on velocity spikes indicative of enumeration
Monitor edge and WAF logs for repetitive RPC POST bodies containing varied key material

How to Mitigate CVE-2026-56300

Immediate Actions Required

Upgrade Capgo to version 12.128.2 or later, which removes the unauthenticated exposure of the affected RPC functions
Rotate all Capgo API keys that may have been probed while a vulnerable version was deployed
Audit access logs for the get_user_id and get_org_perm_for_apikey endpoints going back to first deployment of an affected version

Patch Information

The issue is resolved in Capgo version 12.128.2. Refer to the GitHub Security Advisory GHSA-7r6g-whg3-5mm4 for the fix commit and remediation guidance. The patch enforces authentication and authorization checks on the affected RPC functions.

Workarounds

Revoke execute permissions on get_user_id and get_org_perm_for_apikey for the anon PostgreSQL role until the upgrade is applied
Restrict RPC endpoint access at the reverse proxy or WAF layer to authenticated sessions carrying a valid user JWT
Rate-limit invocations of these two RPC functions per source IP to blunt enumeration attempts

bash

# Revoke anon execute permissions as a temporary mitigation
REVOKE EXECUTE ON FUNCTION public.get_user_id FROM anon;
REVOKE EXECUTE ON FUNCTION public.get_org_perm_for_apikey FROM anon;