CVE-2026-56252

Capgo before 12.128.2 contains a scope isolation vulnerability in the POST /webhooks/test endpoint that allows app-scoped API keys to invoke org-scoped webhook operations. Attackers with app-scoped credentials can trigger signed outbound webhook deliveries for arbitrary organization webhooks outside their declared app boundary, bypassing the limited_to_apps authorization check.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/Cap-go/capgo/security/advisories/GHSA-qvr7-f6j6-64wp
https://www.vulncheck.com/advisories/capgo-scope-isolation-failure-in-webhook-test-endpoint
https://github.com/Cap-go/capgo/security/advisories/GHSA-qvr7-f6j6-64wp

Configurations

No configuration.

History

25 Oct 2026, 15:10

Type	Values Removed	Values Added
Summary		(es) Capgo anterior a 12.128.2 contiene una vulnerabilidad de aislamiento de alcance en el endpoint POST /webhooks/test que permite a las claves API con alcance de aplicación invocar operaciones de webhook con alcance de organización. Atacantes con credenciales con alcance de aplicación pueden desencadenar entregas de webhook salientes firmadas para webhooks de organización arbitrarios fuera de su límite de aplicación declarado, eludiendo la verificación de autorización limited_to_apps.

Information

Published : 2026-07-12 12:16

Updated : 2026-10-25 15:10

NVD link : CVE-2026-56252

Mitre link : CVE-2026-56252

CVE.ORG link : CVE-2026-56252

JSON object : View

Products Affected

No product.

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-56252", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-56252", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-13T16:13:33.349733Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "Capgo", "product": "Capgo", "versions": [{"status": "affected", "version": "0", "lessThan": "12.128.2", "versionType": "semver"}, {"status": "unaffected", "version": "12.128.2", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-12T12:16:44.867", "references": [{"url": "https://github.com/Cap-go/capgo/security/advisories/GHSA-qvr7-f6j6-64wp", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/capgo-scope-isolation-failure-in-webhook-test-endpoint", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/Cap-go/capgo/security/advisories/GHSA-qvr7-f6j6-64wp", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "Capgo before 12.128.2 contains a scope isolation vulnerability in the POST /webhooks/test endpoint that allows app-scoped API keys to invoke org-scoped webhook operations. Attackers with app-scoped credentials can trigger signed outbound webhook deliveries for arbitrary organization webhooks outside their declared app boundary, bypassing the limited_to_apps authorization check."}, {"lang": "es", "value": "Capgo anterior a 12.128.2 contiene una vulnerabilidad de aislamiento de alcance en el endpoint POST /webhooks/test que permite a las claves API con alcance de aplicaci\u00f3n invocar operaciones de webhook con alcance de organizaci\u00f3n. Atacantes con credenciales con alcance de aplicaci\u00f3n pueden desencadenar entregas de webhook salientes firmadas para webhooks de organizaci\u00f3n arbitrarios fuera de su l\u00edmite de aplicaci\u00f3n declarado, eludiendo la verificaci\u00f3n de autorizaci\u00f3n limited_to_apps."}], "lastModified": "2026-10-25T15:10:00.147", "sourceIdentifier": "disclosure@vulncheck.com"}