CVE-2026-56337

Name of the Vulnerable Software and Affected Versions Capgo versions prior to 12.128.2

Description An information disclosure issue exists in the public.exist app v2() RPC function. Unauthenticated remote attackers can enumerate app ids by sending requests to the 'POST /rest/v1/rpc/exist app v2' endpoint using arbitrary appid parameters. This is possible because the function is defined as a SECURITY DEFINER, which allows it to run with the privileges of the user who created it, enabling attackers to verify the existence of specific IDs within the public.apps table and leading to cross-tenant app enumeration.

Recommendations Update Capgo to version 12.128.2 or later. As a temporary mitigation, restrict access to the 'POST /rest/v1/rpc/exist app v2' endpoint.