The vulnerability in Capgo prior to version 12.128.2 involves the find_apikey_by_value PostgreSQL function, which is SECURITY DEFINER and accessible by the anon role. This misconfiguration permits unauthenticated attackers to invoke the function through a REST endpoint, disclosing sensitive API key metadata including user identifiers, operational mode, organizational scope, and expiration information. This constitutes an information disclosure issue categorized under CWE-200.

An unauthenticated attacker can retrieve sensitive API key metadata by invoking the vulnerable function with a valid key value. This exposure includes user IDs, mode, organization scoping, and expiration details, potentially aiding further attacks or unauthorized access. There is no indication of privilege escalation or direct system compromise from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, restrict access to the vulnerable endpoint and review database function permissions to limit anon role execution where possible.