CVE-2026-56318 · Symaro Security Advisory

Description

Capgo before 12.128.2 contains an information disclosure vulnerability in the /private/validate_password_compliance endpoint that returns different error responses for malformed, non-existent, and existing organization IDs. Unauthenticated attackers can enumerate valid organization UUIDs by observing response status codes and error messages, allowing confirmation of organization existence.

Severity (CVSS)

Base score	6.9
Severity	Medium
Version	CVSS 4.0
Vector	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Provided by	CNA

Weaknesses

CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor

Affected products

Vendor	Product	Versions
Capgo	Capgo	0 to <12.128.2; 12.128.2

References

https://github.com/Cap-go/capgo/security/advisories/GHSA-fwwh-rqv7-6pjf (vendor-advisory)
https://www.vulncheck.com/advisories/capgo-information-disclosure-via-private-validate-password-compliance-endpoint (third-party-advisory)

Authoritative sources

This page is a snapshot. For the latest enrichment and updates, view the record on CVE.org or the NVD.

Generated from the official CVE List on 01 Jul 2026 07:05 UTC.