SEPTEMBER 18, 2026
Live Feed
Back to database
Case File

CVE-2026-56240

MEDIUM · CVSS 4.3 EPSS 0.18% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-07-11 · Last synced 2026-08-10

CyberRota Analysis

AI-Generated

Capgo versions prior to 12.128.12 are vulnerable to a billing authorization bypass due to a flaw in the plan_valid calculation, enabling unauthorized access to critical endpoints even after usage credits are exhausted or expired. This vulnerability allows attackers to exploit discrepancies between the plugin's plan_valid expression and the billing gate, potentially leading to unauthorized data access. Organizations using affected versions should prioritize patching to mitigate the risk of unauthorized access to sensitive functionalities.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Detected Signals
exploit
GitHub PoC Links

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-56240
Severity
MEDIUM
CVSS
4.3
EPSS
0.18%

Original NVD Description

Capgo before 12.128.12 contains a billing authorization bypass vulnerability in the plan_valid calculation that allows organizations with exhausted or expired usage credit grants to bypass billing gates. Attackers can exploit the divergence between the plugin hot-path plan_valid expression and the authoritative billing gate to gain continued access to /updates, /stats, /channel_self, and attachment upload endpoints after credit depletion.