CVE-2026-56222: Capgo - Cross-Organization App Takeover via Mismatched org_id and app_id in /private/role_bindings
Capgo before 12.128.2 contains an authorization bypass vulnerability in POST /private/rolebindings that fails to verify appid ownership during app-scoped role binding creation. An attacker with administrative privileges in one organization can create role bindings targeting applications owned by other organizations, enabling unauthorized read and modification of victim applications.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Capgoto a version that resolves this vulnerability.Fixed in 12.128.2 - Compensating control
Restrict the ability to create role bindings (e.g., limit administrative access) so attackers cannot create app-scoped role bindings with a mismatched org_id/app_id across organizations via POST /private/role_bindings.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56222?
CVE-2026-56222 has a high severity rating of 7.2.
How does CVE-2026-56222 affect Capgo applications?
CVE-2026-56222 allows an attacker with administrative privileges to exploit an authorization bypass when creating role bindings for applications in other organizations.
What should I do to mitigate CVE-2026-56222?
To mitigate CVE-2026-56222, upgrade to Capgo version 12.128.2 or later, which addresses this vulnerability.
Who is impacted by CVE-2026-56222?
Organizations using Capgo prior to version 12.128.2 with administrative privileges are at risk of exploitation from CVE-2026-56222.
Is there a proof of concept for CVE-2026-56222?
Details regarding proof of concept for CVE-2026-56222 have not been publicly disclosed.