# CVE-2026-56240: Capgo billing authorization bypass in plan_valid calculation

Source: https://junglewise.ai/threats/cve-2026-56240-capgo-billing-authorization-bypass-in-plan-valid-calculation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-11. Updated: 2026-07-11  
License: CC BY 4.0 with a link back

CVE-2026-56240 · Severity: medium · CVSS 4.3 · Published 2026-07-11

Capgo, a platform for managing app updates and statistics, contained a flaw that allowed organizations to bypass billing restrictions. Users with expired or exhausted usage credits could continue to access premium features, such as delivering app updates and uploading attachments, without payment. This could lead to unauthorized service usage and loss of revenue for the service provider.

Technologies: [Capgo](https://junglewise.ai/threats/technologies/capgo). Vendors: [Capgo](https://junglewise.ai/threats/vendors/capgo).

## Quick answers

**Is CVE-2026-56240 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-56240 being exploited in the wild.

**How severe is CVE-2026-56240?** Medium severity, with a CVSS score of 4.3, published 11 July 2026.

**Which products and versions are affected?** Capgo < 12.128.12.

**Is there a fix for CVE-2026-56240?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-56240 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-56240?** Check whether you run Capgo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A billing authorization bypass exists in Capgo due to a logic divergence between the plugin hot-path 'plan_valid' expression and the authoritative billing gate. The 'plan_valid' check incorrectly relies on the 'orgs.has_usage_credits' flag, which only indicates if a credit grant record exists, rather than verifying if the credits are unexpired or have a positive balance. An authenticated attacker with an exhausted or expired credit grant can exploit this to maintain access to restricted endpoints including /updates, /stats, /channel_self, and attachment uploads. The issue was addressed in version 12.128.12 by ensuring the validation logic correctly checks for available, unexpired credits.

## Affected products

- Capgo Capgo < 12.128.12

## Timeline

- 2026-05-08: advisory: GitHub Security Advisory published
- 2026-07-11: disclosed: NVD publication date

## References

- [https://github.com/Cap-go/capgo/security/advisories/GHSA-g9fc-82c2-p2r6](https://github.com/Cap-go/capgo/security/advisories/GHSA-g9fc-82c2-p2r6)
- [https://www.vulncheck.com/advisories/capgo-billing-authorization-bypass-via-exhausted-usage-credits](https://www.vulncheck.com/advisories/capgo-billing-authorization-bypass-via-exhausted-usage-credits)

## Related threats

- [Capgo access control bypass in SSO provider configuration](https://junglewise.ai/threats/cve-2026-100612-capgo-capgo-app-through-version-12-261-0-contains-an-incomplete)
- [Capgo information disclosure in SSO check-domain endpoint](https://junglewise.ai/threats/cve-2026-56336-capgo-information-disclosure-in-sso-check-domain-endpoint)
- [Capgo improper authorization in SSO prelink endpoint](https://junglewise.ai/threats/cve-2026-56313-capgo-improper-authorization-in-sso-prelink-endpoint)
- [Capgo insufficient authentication in email change endpoint](https://junglewise.ai/threats/cve-2026-56308-capgo-insufficient-authentication-in-email-change-endpoint)
- [Capgo SQL injection in admin_stats endpoint](https://junglewise.ai/threats/cve-2026-56281-capgo-sql-injection-in-admin-stats-endpoint)