PT-2026-51037 · Cap Go · Cap-Go

Judel777 · Published 2026-06-19 · Updated 2026-06-19 · CVE-2026-56079

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Capgo versions prior to 12.128.2

Description A cross-tenant authorization bypass exists in PostgREST endpoints. This issue allows API keys with organization-level read permissions to access webhook secrets and delivery logs belonging to other tenants. An attacker can query the "/webhooks" and "/webhook deliveries" endpoints to exfiltrate HMAC (Hash-based Message Authentication Code) signing secrets and delivery payloads, which can be used to forge webhook events against victim organizations.

Recommendations Update to version 12.128.2 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-56079

Affected Products

Cap-Go

References · 4

• https://github.com/Cap-go/capgo/security/advisories/GHSA-hj3h-v877-g5rx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-56079 · Security Note
• https://vulncheck.com/advisories/capgo-cross-tenant-authorization-bypass-via-postgrest-webhook-access · Note
• https://twitter.com/VulmonFeeds/status/2068116593519816726 · Twitter Post