CVE-2026-56319: Capgo Information Disclosure Vulnerability

CVE-2026-56319 Overview

CVE-2026-56319 is an information disclosure vulnerability in Capgo versions prior to 12.128.2. The flaw resides in the GET /statistics/app/:app_id endpoint, which returns differential error responses for inaccessible apps versus nonexistent ones. App-limited API keys receive 500 PGRST116 errors when querying real app IDs outside their scope, while nonexistent app IDs return 401 errors. Attackers can use this oracle to enumerate sibling tenant app IDs, breaking tenant isolation. The weakness is classified under CWE-203: Observable Discrepancy.

Critical Impact
An authenticated attacker with a low-privilege app-limited API key can enumerate valid app IDs belonging to other tenants, undermining multi-tenant boundaries.

Affected Products

Capgo versions prior to 12.128.2
GET /statistics/app/:app_id API endpoint
Multi-tenant Capgo deployments using app-limited API keys

Discovery Timeline

2026-06-20 - CVE-2026-56319 published to NVD
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2026-56319

Vulnerability Analysis

The vulnerability is a classic observable discrepancy flaw in the Capgo statistics API. When a client authenticates with an app-limited API key and requests statistics for an app_id outside its allowed scope, the backend attempts to query the database before evaluating authorization. If the queried app exists but is owned by another tenant, the PostgREST layer raises a PGRST116 error, surfaced as HTTP 500. If the app does not exist at all, the authorization layer rejects the request with HTTP 401.

This behavioral split creates an existence oracle. By iterating candidate app IDs and observing the response code, an attacker maps which identifiers correspond to real applications across the platform. The information disclosed is bounded to app ID existence, but it directly defeats tenant opacity assumptions in a multi-tenant SaaS context.

Root Cause

The root cause is incorrect ordering of authorization and data-access logic. The endpoint queries the database for the target app_id before validating that the caller's API key scope includes that app. Errors from the database layer are propagated to the client without normalization, allowing the caller to distinguish a permission failure from a not-found condition.

Attack Vector

Exploitation requires only a valid app-limited API key, which any legitimate Capgo customer can obtain. The attacker issues GET /statistics/app/:app_id requests against guessed or harvested app identifiers over the network. Responses returning 500 PGRST116 confirm a real app ID outside the attacker's scope; 401 responses indicate the ID does not exist. No user interaction is required, and the attack can be fully automated.

No verified public proof-of-concept code is available. Refer to the GitHub Security Advisory GHSA-73p9-mprg-7r75 and the VulnCheck Security Advisory for additional technical context.

Detection Methods for CVE-2026-56319

Indicators of Compromise

High volume of GET /statistics/app/:app_id requests from a single API key targeting many distinct app IDs.
Elevated rate of HTTP 500 responses containing PGRST116 error codes in Capgo API logs.
Sequential or dictionary-style enumeration patterns in app_id path parameters.

Detection Strategies

Aggregate API request logs by API key and count unique app_id values queried per hour to flag enumeration behavior.
Alert when a single API key produces a sustained ratio of 500 PGRST116 and 401 responses across many distinct app IDs.
Correlate failed statistics lookups with the API key's known scope to detect out-of-scope access attempts.

Monitoring Recommendations

Ingest Capgo API access logs into a centralized logging or SIEM platform for behavioral analysis.
Establish a baseline of normal app ID query diversity per API key and alert on statistical outliers.
Track EPSS movement for CVE-2026-56319 (currently 0.187%) to reprioritize if exploitation activity emerges.

How to Mitigate CVE-2026-56319

Immediate Actions Required

Upgrade Capgo to version 12.128.2 or later, where the endpoint normalizes responses regardless of app existence.
Audit recent API access logs for app-limited keys exhibiting enumeration patterns and revoke suspicious keys.
Rotate API keys that may have been used to map sibling tenant app IDs.

Patch Information

The vendor released a fix in Capgo 12.128.2. The patch aligns authorization checks before database queries and returns uniform error responses for both unauthorized and nonexistent app IDs. Full remediation details are published in the GitHub Security Advisory GHSA-73p9-mprg-7r75.

Workarounds

Place an API gateway or reverse proxy in front of Capgo to normalize 500 and 401 responses on the statistics endpoint into a single generic error.
Apply per-API-key rate limiting on /statistics/app/:app_id to slow enumeration attempts.
Restrict issuance of app-limited API keys and review existing key scopes until the upgrade is deployed.

bash

# Example: nginx response normalization for the statistics endpoint
location ~ ^/statistics/app/ {
    proxy_pass http://capgo_backend;
    proxy_intercept_errors on;
    error_page 401 500 =403 /generic_forbidden;
}

location = /generic_forbidden {
    internal;
    return 403 '{"error":"forbidden"}';
}