PT-2026-51500 · Cap Go · Cap-Go

Zerlyer · Publicado 2026-06-23 · Atualizado 2026-06-23 · CVE-2026-56222

Mitre

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Capgo before 12.128.2 contains an authorization bypass vulnerability in POST /private/role bindings that fails to verify app id ownership during app-scoped role binding creation. An attacker with administrative privileges in one organization can create role bindings targeting applications owned by other organizations, enabling unauthorized read and modification of victim applications.

Correção

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2026-56222

Produtos afetados

Cap-Go

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-56222 · Nota de Segurança
• https://vulncheck.com/advisories/capgo-cross-organization-app-takeover-via-mismatched-org-id-and-app-id-in-private-role-bindings · Nota
• https://github.com/Cap-go/capgo/security/advisories/GHSA-5r52-m8r9-7f8x · Aviso do Fabricante