CVE-2026-56331

Name of the Vulnerable Software and Affected Versions Capgo versions prior to 12.128.2

Description Improper error handling occurs in the '/private/accept invitation' endpoint. When an invalid magic invite string is provided, the system returns an HTTP 500 Internal Server Error instead of a standard 4xx client error. An attacker can use a public key to submit malformed magic invite string values, triggering server errors that may leak internal processing details.

Recommendations Update to version 12.128.2 or later. As a temporary mitigation, restrict access to the '/private/accept invitation' endpoint or avoid using the magic invite string parameter until the update is applied.