CVE-2026-56249

Name of the Vulnerable Software and Affected Versions Capgo versions prior to 12.128.2

Description An authorization bypass exists in the channel creation endpoint. Authenticated users with app.create channel permission can overwrite existing channels by reusing their names. This is possible due to a logic mismatch between existence validation and upsert operations, which allows attackers to reassign channel ownership and modify critical production channel configurations.

Recommendations Update to version 12.128.2 or later.