PT-2026-57549 · Cap Go · Cap-Go

Judel777 · Published 2026-07-12 · Updated 2026-07-12 · CVE-2026-56252

NVD

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Capgo before 12.128.2 contains a scope isolation vulnerability in the POST /webhooks/test endpoint that allows app-scoped API keys to invoke org-scoped webhook operations. Attackers with app-scoped credentials can trigger signed outbound webhook deliveries for arbitrary organization webhooks outside their declared app boundary, bypassing the limited to apps authorization check.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-56252

Affected Products

Cap-Go

References · 3

• https://github.com/Cap-go/capgo/security/advisories/GHSA-qvr7-f6j6-64wp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-56252 · Security Note
• https://vulncheck.com/advisories/capgo-scope-isolation-failure-in-webhook-test-endpoint · Note