Quick answers
- Is CVE-2026-56246 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-56246 being exploited in the wild.
- How severe is CVE-2026-56246?
- High severity, with a CVSS score of 8.1, published 8 July 2026.
- Which products and versions are affected?
- Capgo < 12.128.2.
- Is there a fix for CVE-2026-56246?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-56246 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-56246?
- Check whether you run Capgo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A broken access control vulnerability exists in Capgo's organization management API due to improper privilege inheritance. The root cause is located in the route-level authorization function `rbac_check_permission_direct`, which evaluates the API key owner's user privileges before enforcing the key's `limited_to_orgs` scope. An attacker with administrative access to two organizations can create a write-mode API key restricted to one organization and use it to perform destructive operations (such as `DELETE /organization` or `DELETE /organization/members`) against the other. While Row Level Security (RLS) may block some database writes, certain service-role operations (like image deletion and RBAC role stripping) occur before or outside the RLS scope, leading to successful unauthorized state changes. The issue is fixed in version 12.128.2.
Affected products
- Capgo Capgo < 12.128.2
Timeline
- 2026-05-07: advisory: GitHub Security Advisory published
- 2026-07-08: disclosed: NVD publication date