CVE-2026-56247

Name of the Vulnerable Software and Affected Versions Capgo versions prior to 12.128.2

Description Organization administrators can assign organization-scoped Role-Based Access Control (RBAC) roles at the application scope without validation of role scope compatibility. This issue extends to pending invitees, allowing attackers to pre-seed malformed high-privilege bindings that persist after the invitation is accepted. Consequently, users who should have low privileges can perform unauthorized privileged application actions.

Recommendations Update to version 12.128.2 or later.