CVE-2026-56241: Capgo - RBAC Demotion Privilege Retention via Stale org_users.user_right
Capgo before 12.128.2 contains a privilege escalation vulnerability where demoted superadmin users retain access to deletenoncompliantbundles and countnoncompliantbundles RPCs due to stale orgusers.userright column not being cleared during role binding deletion. Attackers can exploit this by maintaining a previously granted superadmin role to enumerate and bulk delete non-compliant bundles across the entire organization indefinitely.
Affected Software
Event History
Frequently Asked Questions
What is the risk level of CVE-2026-56241?
The risk level of CVE-2026-56241 is rated as high with a score of 7.2.
What is CVE-2026-56241?
CVE-2026-56241 is a privilege escalation vulnerability in Capgo where demoted super_admin users retain unauthorized access due to a stale org_users.user_right column.
How can I mitigate CVE-2026-56241?
To mitigate CVE-2026-56241, ensure you upgrade to Capgo version 12.128.2 or later, which addresses this vulnerability.
What type of access is affected by CVE-2026-56241?
CVE-2026-56241 allows demoted super_admin users to still access the delete_non_compliant_bundles and count_non_compliant_bundles RPCs.
Is CVE-2026-56241 present in earlier versions of Capgo?
Yes, CVE-2026-56241 is present in versions of Capgo prior to 12.128.2.