PT-2026-51222 · Cap Go · Cap-Go

Highriderx · Published 2026-06-21 · Updated 2026-06-21 · CVE-2026-56251

Mitre

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Capgo before 12.128.2 contains a broken row level security policy in the org users table that allows authenticated users to elevate privileges from admin to super admin. Attackers can exploit the insufficient RLS enforcement to gain unauthorized super admin access and compromise system security.

Fix

Incorrect Privilege Assignment

Weakness Enumeration

CWE-266

Related Identifiers

CVE-2026-56251

Affected Products

Cap-Go

References · 3

• https://github.com/Cap-go/capgo/security/advisories/GHSA-9xqh-f26v-9c9h · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-56251 · Security Note
• https://vulncheck.com/advisories/capgo-privilege-escalation-via-broken-row-level-security-in-org-users · Note