Is CVE-2026-56296 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-56296 being exploited in the wild.

How severe is CVE-2026-56296?

Medium severity, with a CVSS score of 5.3, published 11 July 2026.

Is there a fix for CVE-2026-56296?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-56296 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-56296?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-56296: Cap-go information disclosure in transfer_app RPC function

CVE-2026-56296 · Severity: medium · CVSS 5.3 · Published 2026-07-11

Cap-go, a platform for managing app updates, contained a flaw in how it handled requests to transfer applications between organizations. An unauthorized person could use this flaw to guess and confirm the existence of private application IDs by observing different error messages returned by the system. This could allow an attacker to map out valid application and tenant IDs, which could be used to plan more targeted attacks or leak sensitive business metadata.

Quick answers

Is CVE-2026-56296 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-56296 being exploited in the wild.
How severe is CVE-2026-56296?: Medium severity, with a CVSS score of 5.3, published 11 July 2026.
Which products and versions are affected?: Cap-go capgo < 12.128.2.
Is there a fix for CVE-2026-56296?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-56296 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-56296?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An information disclosure vulnerability (CWE-203) exists in Cap-go versions prior to 12.128.2 due to an observable discrepancy in the 'public.transfer_app' RPC function. The function was incorrectly granted execution permissions to unauthenticated ('anon') users and was defined with 'SECURITY DEFINER' privileges. When called with only a publishable API key, the function returns 'App not found' for non-existent IDs but 'You are not authorized...' for existing IDs. This allows a remote, unauthenticated attacker to perform an automated enumeration of valid application IDs. The issue was resolved in version 12.128.2 by revoking public execution permissions and ensuring uniform error responses.

Affected products

Cap-go capgo < 12.128.2

Timeline

2026-03-03: advisory: GitHub Security Advisory published
2026-07-11: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.