Is CVE-2026-56336 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-56336 being exploited in the wild.

How severe is CVE-2026-56336?

Medium severity, with a CVSS score of 5.3, published 12 July 2026.

Is there a fix for CVE-2026-56336?

A patch was published on 2026-07-12: Fix confirmed in version 12.128.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-56336 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-56336?

Check whether you run Capgo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-56336: Capgo information disclosure in SSO check-domain endpoint

CVE-2026-56336 · Severity: medium · CVSS 5.3 · Published 2026-07-12

Capgo, a tool used for managing app updates and deployments, contains a flaw in its Single Sign-On (SSO) domain check feature. An unauthorized person can query the system to reveal internal organization and provider identifiers associated with specific email domains. While this does not grant direct access to customer data, it allows attackers to map out corporate structures and identify which security providers a company uses, which can be used to plan more targeted phishing or social engineering attacks.

Technologies: Capgo. Vendors: Capgo.

Quick answers

Is CVE-2026-56336 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-56336 being exploited in the wild.
How severe is CVE-2026-56336?: Medium severity, with a CVSS score of 5.3, published 12 July 2026.
Which products and versions are affected?: Capgo before 12.128.2.
Is there a fix for CVE-2026-56336?: A patch was published on 2026-07-12: Fix confirmed in version 12.128.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-56336 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-56336?: Check whether you run Capgo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An information disclosure vulnerability exists in the Capgo backend due to the exposure of unnecessary internal fields in the SSO domain verification endpoint. The '/private/sso/check-domain' endpoint, which is intentionally unauthenticated to allow the login page to detect SSO requirements, returns 'org_id' and 'provider_id' UUIDs that are not consumed by the frontend client. An attacker can exploit this by sending POST requests with various email domains to the endpoint. By rotating source IPs to bypass the basic rate limiting, an adversary can perform bulk reconnaissance to map domains to internal organization identifiers and identify configured SSO providers. The issue is resolved in version 12.128.2 by removing these unused fields from the JSON response.

Affected products

Capgo Capgo before 12.128.2

Timeline

2026-05-07: advisory: GitHub Security Advisory published by vendor
2026-07-12: disclosed: CVE published to NVD dataset
2026-07-12: patched: Fix confirmed in version 12.128.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.