PT-2026-54031 · Cap Go · Cap-Go
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Capgo versions prior to 12.128.2
Description
Unauthenticated security definer RPC functions
get user id() and get org perm for apikey() expose API key validity oracles and user UUID disclosure. An unauthenticated attacker using a public API key can validate leaked keys, enumerate users and applications, and determine permission levels, which increases the actionability of compromised credentials.Recommendations
Update to version 12.128.2 or later.
As a temporary mitigation, restrict access to the
get user id() and get org perm for apikey() functions.Exploit
Fix
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Cap-Go