CVE-2026-56293: Capgo - Stale Cross-Organization Authorization via Incomplete deploy_history Update in transfer_app()
Capgo before 12.128.2 contains an authorization flaw in transferapp() that fails to update deployhistory.ownerorg when transferring applications between organizations. Attackers can exploit this omission to retain unauthorized access to deployment history records in the source organization or cause the destination organization to lose access to transferred application deployment records.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Capgoto a version that resolves this vulnerability.Fixed in 12.128.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56293?
The severity of CVE-2026-56293 is medium with a CVSS score of 5.3.
How do I fix CVE-2026-56293?
To fix CVE-2026-56293, update Capgo to version 12.128.2 or later.
What is the impact of CVE-2026-56293?
CVE-2026-56293 allows attackers to retain unauthorized access to deployment history records when applications are transferred between organizations.
Which software is affected by CVE-2026-56293?
CVE-2026-56293 affects Capgo versions prior to 12.128.2.
When was CVE-2026-56293 published?
CVE-2026-56293 was published on July 8, 2026.