---
id: CVE-2026-56242
title: >-
  Capgo - Unauthenticated API Key Validity Oracle and User Identity Disclosure
  via get_identity_apikey_only RPC
summary: >-
  Capgo before 12.128.2 contains an unauthenticated security definer RPC
  function get_identity_apikey_only that returns the owning user_id for supplied
  API keys, creating an API key validity oracle and user identity disclosure
  primitive. A…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-200
vendor: Capgo
product: Capgo
affected:
  - Capgo < 12.128.2
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-06-22T12:19:34.277737Z'
exploitAvailable: true
published: '2026-06-21'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:05:42.933Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-56242'
references:
  - url: 'https://github.com/Cap-go/capgo/security/advisories/GHSA-fhgj-7376-qxwx'
    label: GitHub Security Advisory (GHSA-fhgj-7376-qxwx)
  - url: >-
      https://www.vulncheck.com/advisories/capgo-unauthenticated-api-key-validity-oracle-and-user-identity-disclosure-via-get-identity-apikey-only-rpc
    label: >-
      VulnCheck Advisory: Capgo - Unauthenticated API Key Validity Oracle and
      User Identity Disclosure via get_identity_apikey_only RPC
tags:
  - cve.org
  - exploit-available
epss: 0.00439
epssPercentile: 0.38436
ingestedAt: '2026-11-08T14:51:22.361Z'
---

## Overview

Capgo before 12.128.2 contains an unauthenticated security definer RPC function get_identity_apikey_only that returns the owning user_id for supplied API keys, creating an API key validity oracle and user identity disclosure primitive. Attackers can call this endpoint with valid or invalid API keys to confirm key validity and map keys to user identifiers, then chain results into other exposed RPCs like get_orgs_v6 to retrieve organization membership and management email PII.

## Affected

- `Capgo < 12.128.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.