CVE-2026-56303

🗓️ 11 Jul 2026 13:00:57Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 48 Views🌐 WEB

Capgo prior to 12.128.2 exposes API key metadata via unauthenticated find_apikey_by_value RPC, revealing user_id, mode, org scope, and expiration.

Reporter	Title	Published	Views	Family All 9
attackerkb	CVE-2026-56303	11 Jul 202613:00	–	attackerkb
Circl	CVE-2026-56303	11 Jul 202614:38	–	circl
Cvelist	CVE-2026-56303 Capgo - Unauthenticated API Key Metadata Disclosure via SECURITY DEFINER RPC Function	11 Jul 202613:00	–	cvelist
EUVD	EUVD-2026-43171	11 Jul 202613:00	–	euvd
Mend	CVE-2026-56303	11 Jul 202613:00	–	mend
NVD	CVE-2026-56303	11 Jul 202614:16	–	nvd
Positive Technologies	PT-2026-57429	11 Jul 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-56303: Exposure of Sensitive Information to an Unauthorized Actor	11 Jul 202600:00	–	rapid7
Vulnrichment	CVE-2026-56303 Capgo - Unauthenticated API Key Metadata Disclosure via SECURITY DEFINER RPC Function	11 Jul 202613:00	–	vulnrichment

Vulners

Node

capgo capgoRange0–12.128.2

[
  {
    "vendor": "Capgo",
    "product": "Capgo",
    "defaultStatus": "unaffected",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "versionType": "semver",
        "lessThan": "12.128.2"
      },
      {
        "version": "12.128.2",
        "status": "unaffected",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
github	www.github.com/Cap-go/capgo/security/advisories/GHSA-2xjq-h43m-592f
vulncheck	www.vulncheck.com/advisories/capgo-unauthenticated-api-key-metadata-disclosure-via-security-definer-rpc-function

Parameter	Position	Path	Description	CWE
value	request body	/rest/v1/rpc/find_apikey_by_value	Unauthenticated RPC call can disclose API key metadata by supplying a valid key value to the find_apikey_by_value endpoint.	CWE-200

13 Jul 2026 17:17Current

5.7Medium risk

Vulners AI Score5.7

CVSS 3.17.5

CVSS 48.7

EPSS0.00459

SSVC

CWE-200