CVE-2026-56333

Received Received - Intake

BaseFortify

Publication date: 2026-06-30

Last updated on: 2026-06-30

Assigner: VulnCheck

Description

Capgo before 12.128.2 contains a server-side validation bypass vulnerability in organization security settings that allows authenticated org admins to persist invalid security policy state. Attackers can bypass backend validation by directly updating the public.orgs table from the browser, circumventing field-level validation checks for max_apikey_expiration_days and other security-sensitive configuration parameters.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-30

Last Modified

2026-06-30

Generated

2026-07-01

AI Q&A

2026-07-01

EPSS Evaluated

N/A

NVD

CVE-2026-56333

EUVD

EUVD-2026-40441

Affected Vendors & Products

Vendor	Product	Version / Range
capgo	capgo	to 12.128.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Capgo versions before 12.128.2 and involves a server-side validation bypass in the organization security settings.

Authenticated organization administrators can exploit this issue by directly updating the public.orgs database table from the browser, which allows them to circumvent backend validation checks.

This bypass affects field-level validation for security-sensitive parameters such as max_apikey_expiration_days, enabling the persistence of invalid security policy states.

Impact Analysis

The vulnerability allows attackers with authenticated organization admin privileges to bypass security policy validations and persist invalid or weakened security configurations.

This can lead to reduced security controls, such as improperly configured API key expiration settings, potentially increasing the risk of unauthorized access or prolonged exposure.

Hi! I’m here to help you understand CVE-2026-56333. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70