CVE-2026-56222

Name of the Vulnerable Software and Affected Versions Capgo versions prior to 12.128.2

Description An authorization bypass exists in the 'POST /private/role bindings' endpoint. The system fails to verify the ownership of the app id during the creation of app-scoped role bindings. This allows an attacker with administrative privileges in one organization to create role bindings for applications owned by other organizations, leading to unauthorized reading and modification of those applications.

Recommendations Update to version 12.128.2 or later. As a temporary workaround, restrict access to the 'POST /private/role bindings' endpoint to minimize the risk of exploitation.