Vulnerability · Published Jul 8, 2026 · Assigned by VulnCheck

CVE-2026-56293Capgo - Stale Cross-Organization Authorization via Incomplete deploy_history Update in transfer_app()

Medium 5.4

In plain English

A medium-severity security flaw in Capgo from Capgo. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.2%top 84.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Capgo before 12.128.2 contains an authorization flaw in transfer_app() that fails to update deploy_history.owner_org when transferring applications between organizations. Attackers can exploit this omission to retain unauthorized access to deployment history records in the source organization or cause the destination organization to lose access to transferred application deployment records.

Affected products (as reported)

Vendor	Product	Versions
Capgo	Capgo	0 – before 12.128.2

Weakness: CWE-285 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

References

GitHub Security Advisory (GHSA-854w-xj7g-prv3) vendor-advisory
VulnCheck Advisory: Capgo - Stale Cross-Organization Authorization via Incomplete deploy_history Update in transfer_app() third-party-advisory