PatchSiren cyber security CVE debrief

CVE-2026-56242 Capgo CVE debrief

CVE-2026-56242 is a HIGH-severity vulnerability in Capgo, a product with an unauthenticated security definer RPC function get_identity_apikey_only. This function returns the owning user_id for supplied API keys, creating an API key validity oracle and user identity disclosure primitive. The vulnerability allows attackers to confirm key validity and map keys to user identifiers, potentially leading to further exploitation. Affected users should prioritize patching to limit exposure. The CVE was published on 2026-06-21 with a CVSS score of 8.7.

Vendor: Capgo
Product: Unknown
CVSS: HIGH 8.7
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-06-21
Original CVE updated: 2026-06-22
Advisory published: 2026-06-21
Advisory updated: 2026-06-22

Who should care

Defenders of Capgo installations, especially those with exposed API keys or user identity sensitive information, should be aware of this vulnerability. Security teams responsible for API key management and user identity protection need to assess their exposure and take action. Additionally, developers and administrators of applications using Capgo should review their configurations and update to a patched version.

Technical summary

The vulnerability exists in Capgo before version 12.128.2. An unauthenticated RPC function, get_identity_apikey_only, can be exploited to determine the validity of API keys and disclose user identities. Attackers can use this information to chain attacks into other exposed RPCs, such as get_orgs_v6, to retrieve organization membership and management email PII. The CVSS:4.0 vector is AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

Defensive priority

High priority due to potential for user identity disclosure and API key exploitation.

Recommended defensive actions

Inventory Capgo installations and verify current version
Review and limit exposure of API keys
Update Capgo to version 12.128.2 or later
Monitor for suspicious RPC function calls
Implement compensating controls for API key management

Evidence notes

The primary evidence for this vulnerability comes from the CVE record and NVD detail pages. The vulnerability affects Capgo versions before 12.128.2. The unauthenticated RPC function get_identity_apikey_only can be used to disclose user identities and validate API keys. Defenders should verify their Capgo installations and review API key management practices.

Sources and references

Verified primary and authoritative sources

CVE-2026-56242 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-56242

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-56242 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-56242

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source reference
Unverified legacy reference

URL: https://github.com/Cap-go/capgo/security/advisories/GHSA-fhgj-7376-qxwx

[email protected]
Source reference
Unverified legacy reference

URL: https://www.vulncheck.com/advisories/capgo-unauthenticated-api-key-validity-oracle-and-user-identity-disclosure-via-get-identity-apikey-only-rpc

[email protected]

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.