CVE-2026-56318: Capgo, изтичане на данни

Описание

Оригинално описание

Capgo before 12.128.2 contains an information disclosure vulnerability in the /private/validate_password_compliance endpoint that returns different error responses for malformed, non-existent, and existing organization IDs. Unauthenticated attackers can enumerate valid organization UUIDs by observing response status codes and error messages, allowing confirmation of organization existence.

Засегнати продукти

• Capgo Capgo: преди 12.128.2; 12.128.2

Вид слабост

• CWE-200 Разкриване на чувствителна информация пред неоторизирана страна

История

Други уязвимости в Capgo Capgo

• 8.1CVE-2026-56313
• 6.9CVE-2026-56336
• 8.4CVE-2026-56308
• 5.1CVE-2026-56281
• 5.4CVE-2026-56252

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-56318
• https://nvd.nist.gov/vuln/detail/CVE-2026-56318
• https://github.com/Cap-go/capgo/security/advisories/GHSA-fwwh-rqv7-6pjf
• https://www.vulncheck.com/advisories/capgo-information-disclosure-via-private-validate-password-compliance-endpoint