Server-Side Request Forgery in Capgo Before 12.128.2

Executive Summary

CVE-2026-56227 is a server-side request forgery (SSRF) vulnerability in Capgo versions before 12.128.2. It occurs in the webhook URL validation mechanism, which incorrectly allows organization administrators to configure webhooks pointing to loopback addresses such as localhost or 127.0.0.1.

When these webhooks are triggered, the backend server makes outbound HTTP(S) requests to these internal or loopback addresses. This behavior exposes error responses to users, potentially revealing internal network details.

The root cause is flawed URL validation that permits loopback hosts and fails to reject private or link-local IP ranges, enabling internal network probing.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker with organization admin privileges to perform internal network reconnaissance by configuring webhooks to point to internal or loopback addresses.

The backend server's outbound requests to these addresses can expose error responses that reveal sensitive internal network information.

Such exposure can lead to unauthorized access to internal services, metadata services, or other sensitive resources within the internal network.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves server-side request forgery (SSRF) via webhook URL validation allowing requests to loopback and internal addresses. Detection can focus on identifying webhook configurations pointing to localhost (127.0.0.1), ::1, or other internal IP ranges.

To detect this on your system, you can:

• Review webhook configurations for URLs pointing to loopback addresses such as localhost, 127.0.0.1, or ::1.
• Monitor outbound HTTP(S) requests from the backend to internal IP addresses when webhooks are triggered.
• Use network monitoring tools or commands to detect unusual outbound requests to internal IP ranges.

Example commands that might help include:

• On Linux, use netstat or ss to monitor outbound connections: `netstat -tnp | grep :80` or `ss -tnp` to see active TCP connections.
• Use tcpdump or Wireshark to capture outbound HTTP(S) traffic to internal IPs: `tcpdump -i any dst net 127.0.0.0/8`.
• Check application logs for webhook trigger events that result in requests to loopback or private IP addresses.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include:

• Upgrade Capgo to version 12.128.2 or later, where the vulnerability is fixed.
• Restrict or audit webhook URL configurations to prevent organization admins from setting URLs pointing to loopback (localhost, 127.0.0.1, ::1), link-local, or private IP ranges.
• Implement or enforce validation rules that reject webhook URLs targeting internal or loopback addresses.
• Avoid disclosing raw network error responses to users to prevent leakage of internal network details.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows internal network probing and exposure of error responses that disclose internal network details. This could potentially lead to unauthorized access to sensitive internal resources or metadata services.

Such unauthorized access or data exposure may impact compliance with standards and regulations like GDPR or HIPAA, which require protection of sensitive data and internal systems from unauthorized access or disclosure.

However, the provided information does not explicitly state the direct impact on compliance with these regulations.

Useful 0 Not Useful 0