Vulnerability · Published Jun 23, 2026 · Assigned by VulnCheck

CVE-2026-56222Capgo - Cross-Organization App Takeover via Mismatched org_id and app_id in /private/role_bindings

High 7.2

In plain English

A high-severity authorization bypass via user-controlled key in Capgo from Capgo. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).

Severity (CVSS 3.1)7.2High

Exploit odds (30 days)0.5%top 55.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Capgo before 12.128.2 contains an authorization bypass vulnerability in POST /private/role_bindings that fails to verify app_id ownership during app-scoped role binding creation. An attacker with administrative privileges in one organization can create role bindings targeting applications owned by other organizations, enabling unauthorized read and modification of victim applications.

Affected products (as reported)

Vendor	Product	Versions
Capgo	Capgo	0 – before 12.128.2

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

GitHub Security Advisory (GHSA-5r52-m8r9-7f8x) vendor-advisory
VulnCheck Advisory: Capgo - Cross-Organization App Takeover via Mismatched org_id and app_id in /private/role_bindings third-party-advisory