# CVE-2026-56336: Capgo information disclosure in SSO check-domain endpoint

Source: https://junglewise.ai/threats/cve-2026-56336-capgo-information-disclosure-in-sso-check-domain-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-12. Updated: 2026-07-12  
License: CC BY 4.0 with a link back

CVE-2026-56336 · Severity: medium · CVSS 5.3 · Published 2026-07-12

Capgo, a tool used for managing app updates and deployments, contains a flaw in its Single Sign-On (SSO) domain check feature. An unauthorized person can query the system to reveal internal organization and provider identifiers associated with specific email domains. While this does not grant direct access to customer data, it allows attackers to map out corporate structures and identify which security providers a company uses, which can be used to plan more targeted phishing or social engineering attacks.

Technologies: [Capgo](https://junglewise.ai/threats/technologies/capgo). Vendors: [Capgo](https://junglewise.ai/threats/vendors/capgo).

## Quick answers

**Is CVE-2026-56336 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-56336 being exploited in the wild.

**How severe is CVE-2026-56336?** Medium severity, with a CVSS score of 5.3, published 12 July 2026.

**Which products and versions are affected?** Capgo before 12.128.2.

**Is there a fix for CVE-2026-56336?** A patch was published on 2026-07-12: Fix confirmed in version 12.128.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-56336 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-56336?** Check whether you run Capgo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An information disclosure vulnerability exists in the Capgo backend due to the exposure of unnecessary internal fields in the SSO domain verification endpoint. The '/private/sso/check-domain' endpoint, which is intentionally unauthenticated to allow the login page to detect SSO requirements, returns 'org_id' and 'provider_id' UUIDs that are not consumed by the frontend client. An attacker can exploit this by sending POST requests with various email domains to the endpoint. By rotating source IPs to bypass the basic rate limiting, an adversary can perform bulk reconnaissance to map domains to internal organization identifiers and identify configured SSO providers. The issue is resolved in version 12.128.2 by removing these unused fields from the JSON response.

## Affected products

- Capgo Capgo before 12.128.2

## Timeline

- 2026-05-07: advisory: GitHub Security Advisory published by vendor
- 2026-07-12: disclosed: CVE published to NVD dataset
- 2026-07-12: patched: Fix confirmed in version 12.128.2

## References

- [https://github.com/Cap-go/capgo/security/advisories/GHSA-c5jf-5wxg-mgrq](https://github.com/Cap-go/capgo/security/advisories/GHSA-c5jf-5wxg-mgrq)
- [https://www.vulncheck.com/advisories/capgo-information-disclosure-via-unauthenticated-sso-check-domain-endpoint](https://www.vulncheck.com/advisories/capgo-information-disclosure-via-unauthenticated-sso-check-domain-endpoint)

## Related threats

- [Capgo access control bypass in SSO provider configuration](https://junglewise.ai/threats/cve-2026-100612-capgo-capgo-app-through-version-12-261-0-contains-an-incomplete)
- [Capgo improper authorization in SSO prelink endpoint](https://junglewise.ai/threats/cve-2026-56313-capgo-improper-authorization-in-sso-prelink-endpoint)
- [Capgo insufficient authentication in email change endpoint](https://junglewise.ai/threats/cve-2026-56308-capgo-insufficient-authentication-in-email-change-endpoint)
- [Capgo SQL injection in admin_stats endpoint](https://junglewise.ai/threats/cve-2026-56281-capgo-sql-injection-in-admin-stats-endpoint)
- [Capgo incorrect authorization in webhook test endpoint](https://junglewise.ai/threats/cve-2026-56252-capgo-incorrect-authorization-in-webhook-test-endpoint)