---
id: CVE-2026-56319
title: 'Capgo - App Existence Oracle via GET /statistics/app/:app_id'
summary: >-
  Capgo before 12.128.2 contains an information disclosure vulnerability in the
  GET /statistics/app/:app_id endpoint that allows app-limited API keys to
  distinguish existing sibling app IDs through differential error responses.
  Attackers c…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-203
vendor: Capgo
product: Capgo
affected:
  - Capgo < 12.128.2
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-06-22T13:46:54.315061Z'
exploitAvailable: true
published: '2026-06-20'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:05:59.391Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-56319'
references:
  - url: 'https://github.com/Cap-go/capgo/security/advisories/GHSA-73p9-mprg-7r75'
    label: GitHub Security Advisory (GHSA-73p9-mprg-7r75)
  - url: >-
      https://www.vulncheck.com/advisories/capgo-app-existence-oracle-via-get-statistics-app-app-id
    label: >-
      VulnCheck Advisory: Capgo - App Existence Oracle via GET
      /statistics/app/:app_id
tags:
  - cve.org
  - exploit-available
epss: 0.00306
epssPercentile: 0.23585
ingestedAt: '2026-11-08T14:51:22.357Z'
---

## Overview

Capgo before 12.128.2 contains an information disclosure vulnerability in the GET /statistics/app/:app_id endpoint that allows app-limited API keys to distinguish existing sibling app IDs through differential error responses. Attackers can enumerate real app IDs outside their allowed scope by observing 500 PGRST116 errors for inaccessible apps versus 401 errors for nonexistent apps, breaking tenant isolation.

## Affected

- `Capgo < 12.128.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.