Security Advisory
CVE-2026-56336
5.3
MEDIUM
Vulnerability Description
Capgo before 12.128.2 contains an information disclosure vulnerability in the unauthenticated /private/sso/check-domain endpoint that returns internal org_id and provider_id values. Attackers can enumerate email domains to build mappings of domains to organization UUIDs and SSO provider identifiers, enabling reconnaissance against Capgo tenants.
Published Date
July 12, 2026
Official Source
NIST NVD Advisory