CVE-2026-56336: Capgo Information Disclosure Vulnerability

CVE-2026-56336 Overview

CVE-2026-56336 is an information disclosure vulnerability in Capgo versions before 12.128.2. The unauthenticated /private/sso/check-domain endpoint returns internal org_id and provider_id values when queried with an email domain. Attackers can enumerate arbitrary email domains and build mappings between domains, organization UUIDs, and Single Sign-On (SSO) provider identifiers. This exposure enables tenant reconnaissance against Capgo deployments without authentication. The vulnerability is tracked under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Unauthenticated attackers can enumerate Capgo tenants and harvest organization UUIDs and SSO provider IDs, supporting targeted phishing and follow-on attacks against identified customers.

Affected Products

Capgo versions prior to 12.128.2
The /private/sso/check-domain API endpoint
Capgo multi-tenant SSO configurations

Discovery Timeline

2026-07-12 - CVE-2026-56336 published to the National Vulnerability Database (NVD)
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-56336

Vulnerability Analysis

The flaw resides in the /private/sso/check-domain endpoint exposed by Capgo. The endpoint accepts an email domain as input and responds with internal identifiers, specifically the tenant org_id and the associated provider_id. The endpoint does not require authentication, so any remote party can issue requests directly.

Because the response differentiates between known and unknown domains, an attacker can iterate through domain lists to discover which organizations are hosted on the platform. Each successful response reveals stable UUIDs that identify the tenant and its identity provider. These identifiers can be reused in downstream reconnaissance or crafted authentication flows.

Root Cause

The root cause is missing access control on a diagnostic lookup endpoint that returns backend identifiers. The design assumed the returned values were non-sensitive, but the values map external domains to internal tenant structures. This mismatch between exposed data and authentication requirements defines the CWE-200 exposure.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker sends HTTP requests to /private/sso/check-domain with candidate domains and records the returned identifiers. Full technical detail is available in the GitHub Security Advisory GHSA-c5jf-5wxg-mgrq and the VulnCheck Advisory on Capgo.

Detection Methods for CVE-2026-56336

Indicators of Compromise

High-volume unauthenticated requests to the /private/sso/check-domain endpoint from a single source or distributed set of IP addresses.
Sequential or dictionary-style enumeration of email domains within short time windows.
Requests originating from anonymizing infrastructure such as commercial VPNs, hosting providers, or Tor exit nodes targeting the SSO check endpoint.

Detection Strategies

Parse web server and reverse proxy logs for requests matching /private/sso/check-domain and group by client identity to surface enumeration behavior.
Establish a baseline of legitimate domain lookups and alert when request rates exceed normal thresholds per source IP or Autonomous System Number (ASN).
Correlate responses containing valid org_id or provider_id values with unusual source geographies or User-Agent patterns.

Monitoring Recommendations

Forward web access logs to a centralized Security Information and Event Management (SIEM) platform and build detection rules for the affected endpoint.
Track unique domain values submitted to the endpoint over rolling windows to identify enumeration campaigns.
Enable alerting on requests to unauthenticated internal API paths that return tenant identifiers.

How to Mitigate CVE-2026-56336

Immediate Actions Required

Upgrade Capgo to version 12.128.2 or later, which contains the fix for CVE-2026-56336.
Audit access logs for prior enumeration activity against /private/sso/check-domain and record any exposed tenant identifiers.
Rotate or scope any secrets or workflows that treated org_id or provider_id values as confidential.

Patch Information

The issue is fixed in Capgo 12.128.2. Refer to the GitHub Security Advisory GHSA-c5jf-5wxg-mgrq for patch details and upgrade instructions. The VulnCheck Advisory on Capgo provides additional context on the exposure and remediation.

Workarounds

Restrict access to /private/sso/check-domain at the reverse proxy or Web Application Firewall (WAF) layer until the patch is deployed.
Rate-limit unauthenticated requests to the SSO domain check endpoint by source IP to slow enumeration attempts.
Filter responses to remove internal identifiers such as org_id and provider_id when the caller is unauthenticated.

bash

# Example NGINX configuration to restrict and rate-limit the endpoint
limit_req_zone $binary_remote_addr zone=sso_check:10m rate=5r/m;

location = /private/sso/check-domain {
    limit_req zone=sso_check burst=5 nodelay;
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://capgo_backend;
}