CVE-2026-56257

HIGH 7.1

Capgo - Authorization Bypass in App Ownership Transfer via Direct PostgREST Update

CVSS Score

7.1

EPSS Score

0.0%

EPSS Percentile

0th

Capgo before 12.128.2 allows direct patching of public.apps.owner_org through PostgREST, bypassing the transfer_app() workflow and creating split-brain ownership. Attackers can directly update apps.owner_org while leaving app_versions.owner_org unchanged, enabling old-org keys to retain access to version data while new-org keys control the app record.

CWE	CWE-284
Vendor	capgo
Product	capgo
Published	Jun 24, 2026

Stay Ahead of the Next One

Get instant alerts for capgo capgo

Be the first to know when new high vulnerabilities affecting capgo capgo are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

None

Affected Versions

Capgo / Capgo

0 < 12.128.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/Cap-go/capgo/security/advisories/GHSA-v9jp-r5wh-qqcp vulncheck.com: https://www.vulncheck.com/advisories/capgo-authorization-bypass-in-app-ownership-transfer-via-direct-postgrest-update

Credits

🔍 Judel777