CVE-2026-56222
High
Description
Capgo before 12.128.2 contains an authorization bypass vulnerability in POST /private/role_bindings that fails to verify app_id ownership during app-scoped role binding creation. An attacker with administrative privileges in one organization can create role bindings targeting applications owned by other organizations, enabling unauthorized read and modification of victim applications.
SeverityHigh
CVSS7.2
Exploit probability—
ProductCapgo
PublishedJun 23, 2026
First seenJun 23, 2026
How to fix
Update
- Capgo Capgo12.128.2 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Capgo Capgo | v < 12.128.2 | 12.128.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.