CVE-2026-56293
MediumCVSS 5.4Summary
A vulnerability in Capgo before version 12.128.2 stems from an authorization flaw in the transfer_app() function that fails to update the deploy_history.owner_org field when transferring applications between organizations. Attackers can exploit this omission to retain unauthorized access to deployment history records in the source organization or cause the destination organization to lose access to transferred application deployment records.
Risk Assessment
The organization is at risk of leaking historical deployment data and disrupting application management integrity, potentially leading to confidentiality breaches and operational continuity issues.
Recommendation
Immediately upgrade Capgo to version 12.128.2 or later, which includes a fix for the authorization flaw in the transfer_app() function.
Original NVD description (English source)
Capgo before 12.128.2 contains an authorization flaw in transfer_app() that fails to update deploy_history.owner_org when transferring applications between organizations. Attackers can exploit this omission to retain unauthorized access to deployment history records in the source organization or cause the destination organization to lose access to transferred application deployment records.