Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-56300— Capgo - Unauthenticated API Key Validity and Permission Oracle via RPC Functions

Quick assessment

Affected

Capgo Capgo

Exploitation

Public or AI PoC available; prioritize validation

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Capgo是CAPGO公司的一个专为CapacitorJS开发者打造的移动应用开发和更新平台。 Capgo 12.128.2之前版本存在日志信息泄露漏洞，该漏洞源于未经验证的安全定义RPC函数get_user_id和get_org_perm_for_apikey暴露了API密钥有效性验证机制和用户UUID信息，可能导致未经过身份验证的攻击者使用公共API密钥验证泄露的密钥、枚举用户和应用程序以及确定权限级别，显著增加了被泄露凭据的可用性。

CVSS 7.5 · High EPSS 0.46% · P39 Updated Jul 02, 2026

Possible ATT&CK Techniques 2 AI

T1078 · Valid Accounts T1590.004 · Network Topology

Affected Version Matrix 2

Vendor	Product	Version Range	Status
Capgo	Capgo	`< 12.128.2`	affected
		`12.128.2`	unaffected

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-56300

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Capgo - Unauthenticated API Key Validity and Permission Oracle via RPC Functions

Source: CVE Program / CVE List V5

Vulnerability Description

Capgo before 12.128.2 contains unauthenticated security definer RPC functions get_user_id and get_org_perm_for_apikey that expose API key validity oracles and user UUID disclosure. Unauthenticated attackers using the public API key can validate leaked keys, enumerate users and apps, and determine permission levels, significantly increasing the actionability of compromised credentials.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

信息暴露

Source: CVE Program / CVE List V5

Vulnerability Title

Capgo 日志信息泄露漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Capgo	Capgo	0 ~ 12.128.2	-

II. Public POCs for CVE-2026-56300

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

Qwen3.6-35B-A3B · 8828 chars

Pro+ exclusive includes:

Vulnerability reproduction recording (real sandbox build + trigger, exclusive)

In-depth vulnerability mechanism

Trigger conditions & impact

Full executable POC code

Exploit chain & mitigation

POC zip download

100+ AI POC generations per month

Upgrade to Pro+ to unlock Limited ¥499/month ¥599 Sign up first

III. Intelligence Information for CVE-2026-56300

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-56300 (1)

🔗 Capgo - Unauthenticated API Key Validity and Permission Oracle via RPC Functions | Advisories | VulnCheck third-party-advisory

Other References for CVE-2026-56300 (1)

🔗 Unauthenticated Supabase RPCs expose API key validity + user/org permission oracles (get_user_id, get_org_perm_for_apikey) · Advisory · Cap-go/capgo · GitHub Read full article vendor-advisory

https://www.cve.org/CVERecord?id=CVE-2026-56300

Same Patch Batch · Capgo · 2026-06-30 · 15 CVEs total

CVE-2026-56230	8.8 HIGH	Capgo - Broken Object Level Authorization via x-limited-key-id Header
CVE-2026-56247	8.8 HIGH	Capgo - Privilege Escalation via Cross-Scope RBAC Role Assignment
CVE-2026-56233	8.3 HIGH	Capgo - SSRF and Privilege Escalation via Path Traversal in Builder Upload Proxy
CVE-2026-56286	8.1 HIGH	Capgo - Account Deletion Without Password Confirmation
CVE-2026-56249	7.6 HIGH	Capgo - Unauthorized Channel Overwrite and Ownership Takeover via POST /channel Name Colli
CVE-2026-56219	7.5 HIGH	Capgo - Unauthenticated RBAC Bindings and Email Disclosure via get_org_user_access_rbac NU
CVE-2026-56320	7.1 HIGH	Capgo - Org/App Scope Mismatch in Device Creation Endpoint
CVE-2026-56328	6.5 MEDIUM	Capgo - Integrity Issue in Release Routing via Multiple Public Channels
CVE-2026-56224	5.4 MEDIUM	Capgo - Login CSRF and Session Fixation via URL Query Parameters
CVE-2026-56331	5.3 MEDIUM	Capgo - Improper Error Handling in Accept Invitation Endpoint via Invalid Magic String
CVE-2026-56327	5.3 MEDIUM	Capgo - Unauthenticated Organization Existence Oracle via public.invite_user_to_org RPC
CVE-2026-56318	5.3 MEDIUM	Capgo - Information Disclosure via /private/validate_password_compliance Endpoint
CVE-2026-56333	4.3 MEDIUM	Capgo - Server-Side Validation Bypass via Direct Browser-Side Organization Security Settin
CVE-2026-56334	4.3 MEDIUM	Capgo - Missing UPDATE RLS Policy for Build Status Persistence

IV. Related Vulnerabilities

Same product: Capgo

Same vendor: Capgo

Same weakness: CWE-200