CVE-2026-56296 describes an information disclosure vulnerability in Cap-go's capgo product prior to version 12.128.2. The vulnerability exists in the public.transfer_app RPC function, which returns distinct error messages depending on whether the provided app ID exists. Because these error messages differ, unauthenticated attackers can enumerate valid app IDs by invoking transfer_app using only the publishable API key. This flaw does not require authentication and has a CVSS 4.0 base score of 6.9, indicating a medium severity. No official patch or remediation level has been provided yet, and no known exploits are reported in the wild.

The vulnerability allows unauthenticated attackers to enumerate valid app IDs by observing error message discrepancies. This information disclosure could aid attackers in further targeted attacks or reconnaissance. However, it does not directly allow privilege escalation, data modification, or denial of service. The impact is limited to information disclosure of valid app identifiers.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the public.transfer_app RPC function or implementing additional monitoring for suspicious enumeration activity. Avoid exposing detailed error messages that differentiate valid and invalid app IDs.