PT-2026-56433 · Cap Go · Cap-Go

Judel777 · Published 2026-07-08 · Updated 2026-07-08 · CVE-2026-56293

NVD

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Capgo before 12.128.2 contains an authorization flaw in transfer app() that fails to update deploy history.owner org when transferring applications between organizations. Attackers can exploit this omission to retain unauthorized access to deployment history records in the source organization or cause the destination organization to lose access to transferred application deployment records.

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2026-56293

Affected Products

Cap-Go

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-56293 · Security Note
• https://github.com/Cap-go/capgo/security/advisories/GHSA-854w-xj7g-prv3 · Vendor Advisory
• https://vulncheck.com/advisories/capgo-stale-cross-organization-authorization-via-incomplete-deploy-history-update-in-transfer-app · Note