Vulnerability · Published Jul 12, 2026 · Assigned by VulnCheck

CVE-2026-56252Capgo - Scope Isolation Failure in Webhook Test Endpoint

Medium 5.4

In plain English

A medium-severity incorrect authorization in Capgo from Capgo. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.2%top 89.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Capgo before 12.128.2 contains a scope isolation vulnerability in the POST /webhooks/test endpoint that allows app-scoped API keys to invoke org-scoped webhook operations. Attackers with app-scoped credentials can trigger signed outbound webhook deliveries for arbitrary organization webhooks outside their declared app boundary, bypassing the limited_to_apps authorization check.

Affected products (as reported)

Vendor	Product	Versions
Capgo	Capgo	0 – before 12.128.2

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

References

GitHub Security Advisory (GHSA-qvr7-f6j6-64wp) vendor-advisory
VulnCheck Advisory: Capgo - Scope Isolation Failure in Webhook Test Endpoint third-party-advisory