Get real-time updates on Telegram
CVE-2026-56284: capgo 0 to before 12.128.2
CVE-2026-56284. CVSS 3.1 base score 5.3 (MEDIUM, Vendor/CNA). EPSS 0.00358 (percentile 0.29278), scored 25-Oct-2026.
Affected technology
capgo · 0 to before 12.128.2
Cap-go
Description’s affected range: before 12.128.2
Component: Not specified by the source
Function: public.get_total_metrics
Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required
What an attacker can do
An unauthenticated attacker can probe organization existence and leak sensitive usage metrics including MAU, bandwidth, and install counts by sending POST requests to /rest/v1/rpc/get_total_metrics with valid organization UUIDs. Vendor/CNA’s CVSS 4.0 assessment (base score 6.9/10) rates confidentiality impact as low; integrity and availability impact as none.
- CWE
- CWE-200
- CCR priority
- 21.3 /100 (P4)
- CVSS 3.1
- 5.3 /10 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · Vendor/CNA
- EPSS
- 0.00358 · percentile 0.29278 · 2026-10-25
- KEV
- no
Provenance
- NVD CVE API 2.0 · Source record · observed 2026-10-25 21:44:36.062275+00:00 UTC
Stable permalink: https://cybercodered.org/item/cve-cve-2026-56284.html