CVE-2026-56296 describes an information disclosure vulnerability in Cap-go's capgo product prior to version 12.128.2. The vulnerability exists in the public.transfer_app RPC function, which returns distinct error messages depending on whether an app ID exists. Because the function can be called with only the publishable API key and without authentication, attackers can enumerate valid app IDs by observing these error message discrepancies. This vulnerability has a CVSS 4.0 base score of 6.9, indicating a medium severity level. No official patch or remediation guidance is currently available, and no known exploits are reported in the wild.

The vulnerability allows unauthenticated attackers to enumerate valid app IDs by exploiting differences in error messages from the public.transfer_app RPC function. This information disclosure could facilitate further targeted attacks or reconnaissance but does not directly allow privilege escalation, data modification, or service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit exposure of the publishable API key and monitor for unusual enumeration activity. Avoid relying solely on error messages for access control decisions.