CVE-2026-56320

Name of the Vulnerable Software and Affected Versions Capgo versions prior to 12.128.2

Description An authorization flaw exists where the system fails to validate if the caller-supplied org id parameter matches the owner organization of the target application. This allows authenticated attackers to bypass the organization and application authorization boundary by creating device records for an application using a foreign organization identifier via the 'POST /private/create device' endpoint.

Recommendations Update to version 12.128.2 or later. Avoid using the org id parameter in the 'POST /private/create device' endpoint to reference foreign organizations.