What’s Vulnerable › Vulnerabilities

CVE-2026-56293: Capgo - Stale Cross-Organization Authorization via Incomplete deploy_history Update in transfer_app()

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-08 · updated 2026-07-08
• Weakness: CWE-285

Description

Capgo before 12.128.2 contains an authorization flaw in transfer_app() that fails to update deploy_history.owner_org when transferring applications between organizations. Attackers can exploit this omission to retain unauthorized access to deployment history records in the source organization or cause the destination organization to lose access to transferred application deployment records.

Affected products

• Capgo: before 12.128.2 — fixed in 12.128.2

How to fix

Upgrade to a fixed version: Capgo 12.128.2. Check the vendor advisory for mitigations.

References

• https://github.com/Cap-go/capgo/security/advisories/GHSA-854w-xj7g-prv3
• https://www.vulncheck.com/advisories/capgo-stale-cross-organization-authorization-via-incomplete-deploy-history-update-in-transfer-app
• https://github.com/Cap-go/capgo/security/advisories/GHSA-854w-xj7g-prv3

Get alerted when CVE-2026-56293 or the next vulnerability affects your stack