Vulnerability · Published Jun 30, 2026 · Assigned by VulnCheck

CVE-2026-56318Capgo - Information Disclosure via /private/validate_password_compliance Endpoint

Medium 5.3

In plain English

A medium-severity information exposure in Capgo from Capgo. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.4%top 70.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Capgo before 12.128.2 contains an information disclosure vulnerability in the /private/validate_password_compliance endpoint that returns different error responses for malformed, non-existent, and existing organization IDs. Unauthenticated attackers can enumerate valid organization UUIDs by observing response status codes and error messages, allowing confirmation of organization existence.

Affected products (as reported)

Vendor	Product	Versions
Capgo	Capgo	0 – before 12.128.2

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

GitHub Security Advisory (GHSA-fwwh-rqv7-6pjf) vendor-advisory
VulnCheck Advisory: Capgo - Information Disclosure via /private/validate_password_compliance Endpoint third-party-advisory