Vulnerability · Published Jul 8, 2026 · Assigned by VulnCheck
CVE-2026-56283Capgo - HTML Injection Leading to Open Redirection in Organization Settings
Medium 5.4
In plain English
A medium-severity cross-site scripting in Capgo from Capgo. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities).
Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)0.2%top 93.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Capgo before 12.128.2 contains an html injection vulnerability in the organization settings endpoint that allows attackers to inject malicious HTML content. Attackers can craft payloads in the organization name field to redirect users to untrusted websites, enabling phishing attacks and reputational damage.
Affected products (as reported)
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
References
- GitHub Security Advisory (GHSA-vhvc-gxfh-m85g) vendor-advisory
- VulnCheck Advisory: Capgo - HTML Injection Leading to Open Redirection in Organization Settings third-party-advisory