CVE-2026-56283
MediumCVSS 5.4Summary
An HTML injection vulnerability in Capgo before version 12.128.2 in the organization settings endpoint allows attackers to inject malicious HTML content. By crafting payloads in the organization name field, they can redirect users to untrusted websites, enabling phishing attacks and reputational damage.
Risk Assessment
The risk includes the potential for successful phishing attacks against system users and loss of trust in the organization, potentially leading to data breaches and financial losses.
Recommendation
Immediately update Capgo to version 12.128.2 or later, which fixes this vulnerability. Additionally, implement input validation and sanitization for the organization name field.
Original NVD description (English source)
Capgo before 12.128.2 contains an html injection vulnerability in the organization settings endpoint that allows attackers to inject malicious HTML content. Attackers can craft payloads in the organization name field to redirect users to untrusted websites, enabling phishing attacks and reputational damage.