BaseFortify

Publication date: 2026-06-30

Last updated on: 2026-06-30

Assigner: VulnCheck

Description

Capgo before 12.128.2 contains an authorization flaw in POST /private/create_device that accepts a caller-supplied org_id parameter without validating it matches the target app's owner organization. Authenticated attackers can create device records for an application using a foreign organization identifier, bypassing the intended org/app authorization boundary.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-30

Last Modified

2026-06-30

Generated

2026-07-01

AI Q&A

2026-07-01

EPSS Evaluated

N/A

NVD

CVE-2026-56320

EUVD

EUVD-2026-40437

Affected Vendors & Products

Vendor	Product	Version / Range
capgo	create_device	to 12.128.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-285	The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Capgo versions before 12.128.2 and involves an authorization flaw in the POST /private/create_device endpoint. The flaw allows an authenticated attacker to supply an org_id parameter that is not validated against the target application's owner organization. As a result, attackers can create device records for applications using organization identifiers that do not belong to them, effectively bypassing the intended authorization boundaries between organizations and applications.

Impact Analysis

The impact of this vulnerability is that an authenticated attacker can create device records for applications belonging to other organizations. This unauthorized access can lead to data integrity issues, unauthorized manipulation of application data, and potential misuse of devices associated with foreign organizations. It compromises the security boundary between organizations, potentially leading to further exploitation or unauthorized actions within the affected system.

Hi! I’m here to help you understand CVE-2026-56320. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70