CVE-2026-56240: Capgo - Billing Authorization Bypass via Exhausted Usage Credits
Capgo before 12.128.12 contains a billing authorization bypass vulnerability in the planvalid calculation that allows organizations with exhausted or expired usage credit grants to bypass billing gates. Attackers can exploit the divergence between the plugin hot-path planvalid expression and the authoritative billing gate to gain continued access to /updates, /stats, /channelself, and attachment upload endpoints after credit depletion.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Capgoto a version that resolves this vulnerability.Fixed in 12.128.12
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56240?
CVE-2026-56240 has a medium severity rating of 5.3.
How do I fix CVE-2026-56240?
To fix CVE-2026-56240, upgrade to Capgo version 12.128.12 or later.
What does CVE-2026-56240 affect?
CVE-2026-56240 affects Capgo software prior to version 12.128.12.
What is the risk associated with CVE-2026-56240?
The risk associated with CVE-2026-56240 is a billing authorization bypass for organizations with exhausted or expired usage credits.
Can CVE-2026-56240 be exploited remotely?
Yes, CVE-2026-56240 can be exploited remotely as it requires no user interaction.