CVE-2026-56249 | Capgo before 12.128.2 contains an authorization bypass vulne… | CVSS 7.6 HIGH

Description

Capgo before 12.128.2 contains an authorization bypass vulnerability in the channel creation endpoint that allows authenticated users to overwrite existing channels by reusing their names. Attackers with app.create_channel permission can exploit a logic mismatch between existence validation and upsert operations to reassign channel ownership and modify critical production channel configurations.

Metadata

CVE ID: CVE-2026-56249
State: PUBLISHED
Assigner: VulnCheck
Reserved: 2026-06-19 21:53 UTC
Published: 2026-06-30 22:08 UTC
Last updated: 2026-06-30 22:08 UTC
Primary CWE: CWE-285
Improper Authorization
Vendor / Product: Capgo / Capgo
Sources: cve.org · NVD

Severity & Metrics

7.6 HIGH CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

Affected products (1)

Vendor	Product	Platform	Versions
Capgo	Capgo	—	0 < 12.128.2, 12.128.2

Weakness (CWE)

CWE	Source	Description
CWE-285	cna	Improper Authorization

CVSS scores (2)

Score	Severity	Version	Source	Vector
7.6	HIGH	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
7.2	HIGH	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

References (2)

GitHub Security Advisory (GHSA-vj24-j594-3wv3) https://github.com/Cap-go/capgo/security/advisories/GHSA-vj24-j594-3wv3
VulnCheck Advisory: Capgo - Unauthorized Channel Overwrite and Ownership Takeover via POST /channel Name Collision https://www.vulncheck.com/advisories/capgo-unauthorized-channel-overwrite-and-ownership-takeover-via-post-channel-name-collision