Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2026-56303

Capgo - Unauthenticated API Key Metadata Disclosure via SECURITY DEFINER RPC Function

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

Capgo before 12.128.2 contains an information disclosure vulnerability in the find_apikey_by_value PostgreSQL function marked SECURITY DEFINER and executable by the anon role. Unauthenticated attackers can call this function via the /rest/v1/rpc/find_apikey_by_value endpoint to retrieve sensitive API key metadata including user_id, mode, org scoping, and expiration details when supplied a valid key value.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Capgo Capgo

Default version status: unaffected

  • 0 to < 12.128.2affected
  • 12.128.2unaffected

References