CVE-2026-56318

Name of the Vulnerable Software and Affected Versions Capgo versions prior to 12.128.2

Description An information disclosure issue exists where the '/private/validate password compliance' endpoint returns distinct error responses based on whether organization IDs are malformed, non-existent, or existing. Unauthenticated attackers can exploit this behavior to enumerate valid organization UUIDs by analyzing response status codes and error messages.

Recommendations Update to version 12.128.2 or later. Restrict access to the '/private/validate password compliance' endpoint to minimize the risk of enumeration.