PT-2026-56431 · Cap Go · Cap-Go

Cyberheroes1010 · Published 2026-07-08 · Updated 2026-07-08 · CVE-2026-56283

Mitre

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Capgo before 12.128.2 contains an html injection vulnerability in the organization settings endpoint that allows attackers to inject malicious HTML content. Attackers can craft payloads in the organization name field to redirect users to untrusted websites, enabling phishing attacks and reputational damage.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-56283

Affected Products

Cap-Go

References · 3

• https://github.com/Cap-go/capgo/security/advisories/GHSA-vhvc-gxfh-m85g · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-56283 · Security Note
• https://vulncheck.com/advisories/capgo-html-injection-leading-to-open-redirection-in-organization-settings · Note