CVE-2026-56237— Capgo - Unauthenticated API Key Generation via Client-Side Parameter Manipulation
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-56237
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Capgo - Unauthenticated API Key Generation via Client-Side Parameter Manipulation
Source: NVD (National Vulnerability Database)
Vulnerability Description
Capgo before 12.128.2 contains a broken authentication vulnerability in its API key generation mechanism. API keys are exposed in frontend requests, and the backend fails to validate that keys are securely generated and bound to the authenticated user. An attacker can tamper with the API key parameter in the generation request and supply arbitrary values, generating custom API keys without proper authorization, which can lead to unauthorized access to protected endpoints.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
认证机制不恰当
Source: NVD (National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-56237
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-56237
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-56237 (2)
Same Patch Batch · Capgo · 2026-06-24 · 10 CVEs total
| CVE-2026-56232 | 8.8 HIGH | Capgo - Subkey Scope Bypass in middlewareKey via x-limited-key-id Header |
| CVE-2026-56223 | 8.7 HIGH | Capgo - Account Takeover via Cross-Domain SSO Email Assertion in provision-user |
| CVE-2026-56231 | 7.6 HIGH | Capgo - Broken Object Level Authorization in Build Job Control via jobId Parameter |
| CVE-2026-56244 | 7.1 HIGH | Capgo - Webhook Signing Secret Disclosure via Non-Admin API Key |
| CVE-2026-56256 | 7.1 HIGH | Capgo - Two-Factor Authentication Bypass via Organization Management API |
| CVE-2026-56257 | 7.1 HIGH | Capgo - Authorization Bypass in App Ownership Transfer via Direct PostgREST Update |
| CVE-2026-56302 | 6.5 MEDIUM | Capgo - Unsecured Supabase Images Bucket via Missing Row Level Security |
| CVE-2026-56337 | 5.3 MEDIUM | Capgo - Information Disclosure via Unauthenticated RPC Function exist_app_v2 |
| CVE-2026-56338 | 5.3 MEDIUM | Capgo - Denial of Service in 2FA Email Verification via /auth/v1/otp Endpoint |
IV. Related Vulnerabilities
Same product: Capgo
- CVE-2026-56334
Capgo - Missing UPDATE RLS Policy for Build Status Persisten - CVE-2026-56331
Capgo - Improper Error Handling in Accept Invitation Endpoin - CVE-2026-56333
Capgo - Server-Side Validation Bypass via Direct Browser-Sid - CVE-2026-56328
Capgo - Integrity Issue in Release Routing via Multiple Publ - CVE-2026-56320
Capgo - Org/App Scope Mismatch in Device Creation Endpoint
Same vendor: Capgo
- CVE-2026-56334
Capgo - Missing UPDATE RLS Policy for Build Status Persisten - CVE-2026-56333
Capgo - Server-Side Validation Bypass via Direct Browser-Sid - CVE-2026-56331
Capgo - Improper Error Handling in Accept Invitation Endpoin - CVE-2026-56328
Capgo - Integrity Issue in Release Routing via Multiple Publ - CVE-2026-56320
Capgo - Org/App Scope Mismatch in Device Creation Endpoint
Same weakness: CWE-287
- CVE-2026-58399
@acastellon/auth has an authentication bypass via spoofable - CVE-2026-11387
SMS Alert <= 3.9.5 - Unauthenticated Privilege Escalation vi - CVE-2026-56219
Capgo - Unauthenticated RBAC Bindings and Email Disclosure v - CVE-2026-10560
Unauthenticated Access to Private Flow Build Events and Canc - CVE-2026-55955
Apache Tomcat: EncryptInterceptor not protected against repl
V. Comments for CVE-2026-56237
No comments yet