CVE-2026-56079: Capgo - Cross-Tenant Authorization Bypass via PostgREST Webhook Access
Capgo before 12.128.2 contains a cross-tenant authorization bypass vulnerability in PostgREST endpoints that allows org-scoped read API keys to access other tenants' webhook secrets and delivery logs. Attackers can query the webhooks and webhookdeliveries endpoints to exfiltrate HMAC signing secrets and delivery payloads, enabling forged webhook events against victim organizations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Capgoto a version that resolves this vulnerability.Fixed in 12.128.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56079?
CVE-2026-56079 has a high severity rating of 7.1.
How do I fix CVE-2026-56079?
To fix CVE-2026-56079, update to Capgo version 12.128.2 or later.
What systems are affected by CVE-2026-56079?
CVE-2026-56079 affects versions of Capgo prior to 12.128.2.
What type of vulnerability is CVE-2026-56079?
CVE-2026-56079 is a cross-tenant authorization bypass vulnerability.
What impact does CVE-2026-56079 have?
CVE-2026-56079 allows unauthorized access to other tenants' webhook secrets and delivery logs.