CVE-2026-56293

Name of the Vulnerable Software and Affected Versions Capgo versions prior to 12.128.2

Description An authorization flaw exists in the transfer app() function that occurs when applications are transferred between organizations. The system fails to update the deploy history.owner org variable, which can allow attackers to maintain unauthorized access to deployment history records within the source organization or result in the destination organization losing access to the deployment records of the transferred application.

Recommendations Update to version 12.128.2 or later. As a temporary mitigation, restrict the use of the transfer app() function until the update is applied.