Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Capgo before 12.128.2 contains an information disclosure vulnerability in the GET /statistics/app/:app_id endpoint that allows app-limited API keys to distinguish existing sibling app IDs through differential error responses. Attackers can enumerate real app IDs outside their allowed scope by observing 500 PGRST116 errors for inaccessible apps versus 401 errors for nonexistent apps, breaking tenant isolation.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-56319 Information Disclosure in Capgo Before 12.128.2 via Differential Error Responses https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-56319
Post summary
The text announces the discovery of an information disclosure vulnerability (CVE-2026-56319) affecting Capgo versions prior to 12.128.2, identified as a differential error response issue, and links to a vulnerability database entry.
🚨*CVE* CVE-2026-56319 Capgo before 12.128.2 contains an information disclosure vulnerability in the GET /statistics/app/:app_id endpoint that allows app-limited API keys to distinguish exi… https://www.cve.org/CVERecord?id=CVE-2026-56319 ----- Traducción: CVE-2026-56319 Cap… http://infoflow.cloud`
Post summary
The post announces CVE-2026-56319, detailing an information‑disclosure flaw in Capgo's statistics endpoint, but it offers no PoC, exploit code, patch, or evidence of active exploitation.
CVE-2026-56319 Capgo before 12.128.2 contains an information disclosure vulnerability in the GET /statistics/app/:app_id endpoint that allows app-limited API keys to distinguish exi… https://www.cve.org/CVERecord?id=CVE-2026-56319
Post summary
The text announces an information disclosure vulnerability in Capgo versions prior to 12.128.2 via the GET /statistics/app/:app_id endpoint, allowing app‑limited API keys to detect the existence of apps.