PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-56319 Capgo CVE debrief

CVE-2026-56319 is a medium-severity information disclosure vulnerability in Capgo before 12.128.2. The vulnerability exists in the GET /statistics/app/:app_id endpoint, enabling app-limited API keys to differentiate between existing and non-existent sibling app IDs through distinct error responses. This issue compromises tenant isolation, allowing attackers to enumerate real app IDs outside their permitted scope. The vulnerability has a CVSS score of 5.3 and is considered a medium threat.

Vendor
Capgo
Product
Unknown
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-20
Original CVE updated
2026-06-22
Advisory published
2026-06-20
Advisory updated
2026-06-22

Who should care

Defenders of Capgo applications, particularly those using versions prior to 12.128.2, should be concerned about this vulnerability. The issue affects the tenant isolation mechanism, potentially allowing unauthorized enumeration of app IDs. Organizations using Capgo should assess their exposure and prioritize patching to prevent potential exploitation.

Technical summary

The vulnerability is located in the GET /statistics/app/:app_id endpoint of Capgo. App-limited API keys can exploit this issue to determine the existence of sibling app IDs by analyzing differential error responses. Specifically, inaccessible apps return a 500 PGRST116 error, while non-existent apps return a 401 error. This allows attackers to enumerate valid app IDs outside their authorized scope, effectively breaking tenant isolation. The CVSS vector for this vulnerability is CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

Defensive priority

Medium priority due to potential for enumeration of app IDs, compromising tenant isolation.

Recommended defensive actions

  • Inventory Capgo applications and versions to identify potential exposure.
  • Review and apply the patch to update Capgo to version 12.128.2 or later.
  • Limit exposure by restricting access to the GET /statistics/app/:app_id endpoint.
  • Monitor for unusual patterns of error responses that could indicate exploitation attempts.
  • Implement compensating controls to detect and prevent unauthorized app ID enumeration.

Evidence notes

The primary evidence for this vulnerability comes from the CVE-2026-56319 record and associated references. The vulnerability affects Capgo versions before 12.128.2. Defenders should verify the version of Capgo in use and check for any existing sibling app IDs that could be enumerated. Official sources, such as the CVE record and vendor advisories, should be consulted for accurate information and mitigation strategies.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-56319 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-56319

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-56319 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-56319

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.