CVE-2026-56283: Capgo - HTML Injection Leading to Open Redirection in Organization Settings
Capgo before 12.128.2 contains an html injection vulnerability in the organization settings endpoint that allows attackers to inject malicious HTML content. Attackers can craft payloads in the organization name field to redirect users to untrusted websites, enabling phishing attacks and reputational damage.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Capgoto a version that resolves this vulnerability.Fixed in 12.128.2 - Compensating control
Temporarily monitor organization settings changes and restrict access to the organization settings endpoint to trusted users until the upgrade to Capgo 12.128.2 is completed.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56283?
CVE-2026-56283 has a medium severity score of 4.8.
What type of vulnerability is CVE-2026-56283?
CVE-2026-56283 is an HTML injection vulnerability leading to open redirection in organization settings.
How can I fix CVE-2026-56283?
To fix CVE-2026-56283, update Capgo to version 12.128.2 or later.
What impacts does CVE-2026-56283 have?
CVE-2026-56283 allows attackers to inject malicious HTML content, potentially leading to phishing attacks.
In which software was CVE-2026-56283 found?
CVE-2026-56283 was found in Capgo versions before 12.128.2.