CVE-2026-56323 Overview
CVE-2026-56323 is an information disclosure vulnerability affecting Capgo versions prior to 12.128.2. The flaw resides in the /functions/v1/channel_self endpoint, which fails to enforce authentication on inbound GET requests. Unauthenticated remote attackers can send arbitrary app_id parameters to enumerate non-public channel names, confirm the existence of applications across tenants, and disclose subscription and billing status. The endpoint operates without device binding or session validation, exposing internal rollout channels and tenant metadata. The weakness is categorized under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.
Critical Impact
Unauthenticated attackers can enumerate private channel names, validate application existence across tenants, and leak billing status by issuing crafted GET requests to a single API endpoint.
Affected Products
- Capgo versions prior to 12.128.2
- The /functions/v1/channel_self Supabase edge function endpoint
- Multi-tenant Capgo deployments exposing the channel self endpoint to the internet
Discovery Timeline
- 2026-06-22 - CVE-2026-56323 published to NVD
- 2026-06-23 - Last updated in NVD database
Technical Details for CVE-2026-56323
Vulnerability Analysis
The vulnerability stems from missing authentication and authorization checks on the /functions/v1/channel_self endpoint in Capgo. The endpoint accepts GET requests containing an app_id parameter and returns metadata about the requested application, including non-public channel names used for staged rollouts. Because the endpoint does not require a valid session token, API key, or device binding, any remote actor can query it. Attackers can also infer whether an app_id is registered by observing differential responses, turning the endpoint into an oracle for tenant enumeration. The leaked data includes subscription state and billing status, which can be used to profile customers for targeted attacks.
Root Cause
The root cause is improper access control on a serverless function that exposes internal application state. The endpoint was designed to return self-referential channel data for an authenticated client but does not validate caller identity before processing the app_id query parameter. This results in cross-tenant data exposure consistent with [CWE-200].
Attack Vector
Exploitation requires only network access to the Capgo API and the ability to issue HTTP GET requests. An attacker iterates candidate app_id values, captures channel metadata for valid identifiers, and aggregates the results into a dataset of tenant applications, internal channels, and billing posture. No authentication, user interaction, or privileged access is required. Refer to the VulnCheck Advisory and the GitHub Security Advisory for the disclosed request structure and response behavior.
Detection Methods for CVE-2026-56323
Indicators of Compromise
- High-volume GET requests to /functions/v1/channel_self originating from a single source IP or autonomous system
- Sequential or dictionary-style variation of the app_id query parameter across short time windows
- Requests to the endpoint lacking expected client headers or device identifiers used by legitimate Capgo SDK traffic
Detection Strategies
- Inspect API gateway and edge function logs for unauthenticated calls to /functions/v1/channel_self and alert on enumeration patterns
- Apply rate-based detection rules that flag clients querying more distinct app_id values than any normal client would request
- Correlate response payloads containing channel names or billing fields with the absence of an authenticated session identifier
Monitoring Recommendations
- Forward Capgo and Supabase function logs to a centralized analytics platform and retain them long enough to reconstruct enumeration campaigns
- Baseline normal app_id request distributions per client and alert on statistically significant deviations
- Monitor for follow-on activity such as credential stuffing or phishing targeting tenants whose app_id values appeared in enumeration traffic
How to Mitigate CVE-2026-56323
Immediate Actions Required
- Upgrade Capgo to version 12.128.2 or later, which adds authentication enforcement on the affected endpoint
- Audit edge function logs from the last 90 days for unauthenticated calls to /functions/v1/channel_self and identify exposed app_id values
- Notify tenants whose application identifiers, channel names, or billing status may have been disclosed
Patch Information
The fix is delivered in Capgo 12.128.2. Administrators should pull the updated release and redeploy affected Supabase edge functions. Verify the patched function rejects unauthenticated GET requests with an appropriate HTTP error and does not return channel or billing fields. Patch details are available in the GitHub Security Advisory GHSA-469v-6vw5-hxpq.
Workarounds
- Place the /functions/v1/channel_self endpoint behind a reverse proxy or API gateway that enforces authentication before requests reach the function
- Apply web application firewall rules that block unauthenticated GET requests to the endpoint and rate-limit app_id parameter variation per source
- Rotate any internal channel names that were exposed through prior enumeration to invalidate intelligence collected by attackers
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
