SEPTEMBER 18, 2026
Live Feed
Back to database
Case File

CVE-2026-56252

MEDIUM · CVSS 5.4 EPSS 0.17% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-07-12 · Last synced 2026-08-11

CyberRota Analysis

AI-Generated

A scope isolation vulnerability in Capgo prior to version 12.128.2 allows attackers with app-scoped API keys to execute org-scoped webhook operations via the POST /webhooks/test endpoint. This flaw enables unauthorized triggering of signed outbound webhook deliveries for any organization, circumventing the intended authorization checks. Organizations using affected versions should prioritize patching to mitigate potential exploitation risks.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-56252
Severity
MEDIUM
CVSS
5.4
EPSS
0.17%

Original NVD Description

Capgo before 12.128.2 contains a scope isolation vulnerability in the POST /webhooks/test endpoint that allows app-scoped API keys to invoke org-scoped webhook operations. Attackers with app-scoped credentials can trigger signed outbound webhook deliveries for arbitrary organization webhooks outside their declared app boundary, bypassing the limited_to_apps authorization check.