Vulnerability · Published Jun 30, 2026 · Assigned by VulnCheck

CVE-2026-56333Capgo - Server-Side Validation Bypass via Direct Browser-Side Organization Security Settings Updates

Medium 4.3

In plain English

A medium-severity improper input validation in Capgo from Capgo. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.3%top 79.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Capgo before 12.128.2 contains a server-side validation bypass vulnerability in organization security settings that allows authenticated org admins to persist invalid security policy state. Attackers can bypass backend validation by directly updating the public.orgs table from the browser, circumventing field-level validation checks for max_apikey_expiration_days and other security-sensitive configuration parameters.

Affected products (as reported)

Vendor	Product	Versions
Capgo	Capgo	0 – before 12.128.2

Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References

GitHub Security Advisory (GHSA-964v-j58v-2q3h) vendor-advisory
VulnCheck Advisory: Capgo - Server-Side Validation Bypass via Direct Browser-Side Organization Security Settings Updates third-party-advisory