CVE-2026-56252

Name of the Vulnerable Software and Affected Versions Capgo versions prior to 12.128.2

Description A scope isolation issue exists in the 'POST /webhooks/test' endpoint. This flaw allows users with app-scoped API keys to execute organization-scoped webhook operations, bypassing the limited to apps authorization check. Consequently, an attacker using app-scoped credentials can trigger signed outbound webhook deliveries for arbitrary organization webhooks that fall outside their designated app boundary.

Recommendations Update to version 12.128.2 or later. As a temporary mitigation, restrict access to the 'POST /webhooks/test' endpoint.