CVE-2026-56241
HighCVSS 8.3Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
In Capgo before version 12.128.2, a privilege escalation vulnerability exists where demoted super_admin users retain access to delete_non_compliant_bundles and count_non_compliant_bundles RPCs due to the stale org_users.user_right column not being cleared during role binding deletion. Attackers can exploit this by maintaining a previously granted super_admin role to enumerate and bulk delete non-compliant bundles across the entire organization indefinitely.
Risk Assessment
The risk is that an attacker with access to a demoted super_admin account can permanently delete or enumerate non-compliant bundles, leading to data loss and system integrity compromise.
Recommendation
Immediately upgrade Capgo to version 12.128.2 or later, which fixes this vulnerability by properly clearing the permission column during role deletion.
Other vulnerabilities in Capgo
See all- CVE-2026-56335Medium
An authorization bypass vulnerability in Capgo before version 12.128.2 allows write-scoped API keys to directly modify protected channel configuration fields via PostgREST by exploiting a null authentication check in the immutability trigger. Attackers with write API keys can alter sensitive channel attributes such as public, allow_emulator, and security-related flags outside intended application routes.
- CVE-2026-56329Medium
A vulnerability in Capgo before version 12.128.2 is caused by non-bijective decoding of double underscores to dots in preview hostname parsing. Attackers can register app IDs with underscores that collide with other tenants' dotted app IDs, leading to preview misrouting and denial of preview access for victim applications.
- CVE-2026-56312Medium
A vulnerability in Capgo before version 12.128.2 in the accept_invitation endpoint creates user accounts before captcha validation is enforced. Attackers can bypass captcha protection by sending POST requests with invalid captcha tokens to create unwanted accounts and burn invite links.
- CVE-2026-56309Medium
A vulnerability in Capgo before version 12.128.2 fails to enforce plan/quota restrictions on the /files/upload/attachments endpoint, allowing plan-blocked apps to create publicly readable R2 objects. Attackers can upload arbitrary attachments using upload-scoped API keys that bypass plan checks, persist outside normal bundle metadata, and survive app deletion, enabling storage and bandwidth abuse.
- CVE-2026-56279High
A vulnerability in Capgo before version 12.128.2 discloses information via the get_orgs_v7(userid) RPC function, which remains publicly invokable despite intended private access controls. Unauthenticated attackers can supply arbitrary user UUIDs to retrieve foreign users' organization membership, roles, management emails, and billing metadata.
- CVE-2026-56298Medium
The vulnerability in Capgo before version 12.128.2 fails to strip EXIF metadata from images uploaded via the app information endpoint, exposing sensitive geolocation data. Attackers can upload images containing EXIF metadata to extract geographic location information and other embedded metadata.
- CVE-2026-56293Medium
A vulnerability in Capgo before version 12.128.2 stems from an authorization flaw in the transfer_app() function that fails to update the deploy_history.owner_org field when transferring applications between organizations. Attackers can exploit this omission to retain unauthorized access to deployment history records in the source organization or cause the destination organization to lose access to transferred application deployment records.
- CVE-2026-56283Medium
An HTML injection vulnerability in Capgo before version 12.128.2 in the organization settings endpoint allows attackers to inject malicious HTML content. By crafting payloads in the organization name field, they can redirect users to untrusted websites, enabling phishing attacks and reputational damage.
- CVE-2026-56250High
A vulnerability in Capgo before version 12.128.2 allows upload-scoped API keys to modify the app_versions.r2_path field via PostgREST, enabling retargeting to arbitrary R2 bundle objects. Attackers can patch r2_path to point to victim objects, soft-delete the attacker-controlled version, and trigger the on_version_update cleanup function to delete the victim R2 object, causing denial of service and bundle availability disruption.
- CVE-2026-56246High
A broken access control vulnerability in Capgo before version 12.128.2 allows a scoped API key (limited_to_orgs) to inherit its owner's user permissions, enabling destructive cross-organization actions. A write-mode API key restricted to one organization can still perform operations like DELETE /organization or DELETE /organization/members against another organization.
Original NVD description (English source)
Capgo before 12.128.2 contains a privilege escalation vulnerability where demoted super_admin users retain access to delete_non_compliant_bundles and count_non_compliant_bundles RPCs due to stale org_users.user_right column not being cleared during role binding deletion. Attackers can exploit this by maintaining a previously granted super_admin role to enumerate and bulk delete non-compliant bundles across the entire organization indefinitely.