CVE-2026-56333

MEDIUM

Capgo - Server-Side Validation Bypass via Direct Browser-Side Organization Security Settings Updates

Title source: cna

Description

Capgo before 12.128.2 contains a server-side validation bypass vulnerability in organization security settings that allows authenticated org admins to persist invalid security policy state. Attackers can bypass backend validation by directly updating the public.orgs table from the browser, circumventing field-level validation checks for max_apikey_expiration_days and other security-sensitive configuration parameters.

References (2)

Core 2

Core References

Vendor Advisory vendor-advisory

GitHub Security Advisory (GHSA-964v-j58v-2q3h)

https://github.com/Cap-go/capgo/security/advisories/GHSA-964v-j58v-2q3h

Third Party Advisory third-party-advisory

VulnCheck Advisory: Capgo - Server-Side Validation Bypass via Direct Browser-Side Organization Security Settings Updates

https://www.vulncheck.com/advisories/capgo-server-side-validation-bypass-via-direct-browser-side-organization-security-settings-updates

Scores

CVSS v3 4.3

EPSS 0.0023

EPSS Percentile 14.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-20

Status published

Products (2)

Capgo/Capgo < 12.128.2

Capgo/Capgo 12.128.2

Published Jun 30, 2026

Tracked Since Jul 01, 2026