Vulnerability · Published Jun 30, 2026 · Assigned by VulnCheck

CVE-2026-56249Capgo - Unauthorized Channel Overwrite and Ownership Takeover via POST /channel Name Collision

High 7.6

In plain English

A high-severity security flaw in Capgo from Capgo. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).

Severity (CVSS 3.1)7.6High

Exploit odds (30 days)0.4%top 69.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Capgo before 12.128.2 contains an authorization bypass vulnerability in the channel creation endpoint that allows authenticated users to overwrite existing channels by reusing their names. Attackers with app.create_channel permission can exploit a logic mismatch between existence validation and upsert operations to reassign channel ownership and modify critical production channel configurations.

Affected products (as reported)

Vendor	Product	Versions
Capgo	Capgo	0 – before 12.128.2

Weakness: CWE-285 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

References

GitHub Security Advisory (GHSA-vj24-j594-3wv3) vendor-advisory
VulnCheck Advisory: Capgo - Unauthorized Channel Overwrite and Ownership Takeover via POST /channel Name Collision third-party-advisory