BaseFortify

Publication date: 2026-06-30

Last updated on: 2026-06-30

Assigner: VulnCheck

Description

Capgo before 12.128.2 contains improper error handling in the /private/accept_invitation endpoint that returns HTTP 500 instead of safe 4xx errors when magic_invite_string is invalid. Attackers can trigger this vulnerability using only the public key by submitting malformed magic_invite_string values to cause server errors and leak internal processing details.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-30

Last Modified

2026-06-30

Generated

2026-07-01

AI Q&A

2026-07-01

EPSS Evaluated

N/A

NVD

CVE-2026-56331

EUVD

EUVD-2026-40440

Affected Vendors & Products

Vendor	Product	Version / Range
capgo	capgo	to 12.128.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-209	The product generates an error message that includes sensitive information about its environment, users, or associated data.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Capgo versions before 12.128.2 in the /private/accept_invitation endpoint. When an invalid magic_invite_string is submitted, the server improperly handles the error by returning an HTTP 500 status code instead of a safer 4xx error. This improper error handling can be exploited by attackers who only need the public key to submit malformed magic_invite_string values, causing server errors and potentially leaking internal processing details.

Impact Analysis

The impact of this vulnerability includes the possibility for attackers to cause server errors by submitting malformed inputs, which may lead to the exposure of internal processing details. This can aid attackers in gaining insights into the server's inner workings, potentially facilitating further attacks or exploitation.

Hi! I’m here to help you understand CVE-2026-56331. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70