PT-2026-51500 · Cap Go · Cap-Go

Zerlyer · Published 2026-06-23 · Updated 2026-06-23 · CVE-2026-56222

Mitre

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Capgo before 12.128.2 contains an authorization bypass vulnerability in POST /private/role bindings that fails to verify app id ownership during app-scoped role binding creation. An attacker with administrative privileges in one organization can create role bindings targeting applications owned by other organizations, enabling unauthorized read and modification of victim applications.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-56222

Affected Products

Cap-Go

References · 3

• https://github.com/Cap-go/capgo/security/advisories/GHSA-5r52-m8r9-7f8x · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-56222 · Security Note
• https://vulncheck.com/advisories/capgo-cross-organization-app-takeover-via-mismatched-org-id-and-app-id-in-private-role-bindings · Note