CVE-2026-56251

MEDIUM

Capgo - Privilege Escalation via Broken Row Level Security in org_users

Title source: cna

Description

Capgo before 12.128.2 contains a broken row level security policy in the org_users table that allows authenticated users to elevate privileges from admin to super_admin. Attackers can exploit the insufficient RLS enforcement to gain unauthorized super_admin access and compromise system security.

References (2)

Core 2

Core References

Vendor Advisory vendor-advisory

GHSA Advisory GHSA-9xqh-f26v-9c9h

https://github.com/Cap-go/capgo/security/advisories/GHSA-9xqh-f26v-9c9h

Third Party Advisory third-party-advisory

VulnCheck Advisory: Capgo - Privilege Escalation via Broken Row Level Security in org_users

https://www.vulncheck.com/advisories/capgo-privilege-escalation-via-broken-row-level-security-in-org-users

Scores

CVSS v3 6.5

EPSS 0.0044

EPSS Percentile 36.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-266

Status published

Products (2)

Capgo/Capgo < 12.128.2

Capgo/Capgo 12.128.2

Published Jun 21, 2026

Tracked Since Jun 21, 2026