CVE-2026-56333

Summary

Capgo before 12.128.2 contains a server-side validation bypass vulnerability in organization security settings that allows authenticated org admins to persist invalid security policy state. Attackers can bypass backend validation by directly updating the public.orgs table from the browser, circumventing field-level validation checks for max_apikey_expiration_days and other security-sensitive configuration parameters.

Affected Software

Weaknesses

• CWE-20: Improper Input Validation

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: no
  • Technical Impact: partial

Additional References

• https://github.com/Cap-go/capgo/security/advisories/GHSA-964v-j58v-2q3h

References

• https://github.com/Cap-go/capgo/security/advisories/GHSA-964v-j58v-2q3h
• https://www.vulncheck.com/advisories/capgo-server-side-validation-bypass-via-direct-browser-side-organization-security-settings-updates

• ←Previous
• Next→