Authorization Bypass in Capgo Transfer App Function

Executive Summary

CVE-2026-56293 is a medium-severity vulnerability in Capgo versions before 12.128.2 caused by an authorization flaw in the transfer_app() function.

When transferring applications between organizations, the function updates ownership in several tables but fails to update the deploy_history.owner_org field.

Because deploy_history.owner_org is not updated, the source organization retains unauthorized access to deployment history records, and the destination organization may lose access to those records.

This flaw leads to stale cross-organization deployment history authorization and breaks expected authorization boundaries.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing unauthorized access to deployment history records in the source organization after an application transfer.

It can also cause the destination organization to lose access to important deployment history records, affecting visibility and auditability of deployment progression.

This results in broken authorization boundaries between organizations, potentially exposing sensitive deployment data to unauthorized parties and impairing operational transparency.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the failure to update the deploy_history.owner_org field during application transfers between organizations in Capgo. Detection would require inspecting the deploy_history table to identify records where the owner_org does not match the current organization ownership of the transferred application.

A possible approach is to query the database to find discrepancies between the deploy_history.owner_org field and the current app ownership in related tables such as public.apps.

• Example SQL command to detect stale deploy_history ownership records:
• SELECT dh.* FROM deploy_history dh JOIN public.apps a ON dh.app_id = a.id WHERE dh.owner_org != a.owner_org;

This query identifies deployment history entries whose owner_org does not match the current owner_org of the app, indicating potential stale or unauthorized access due to the vulnerability.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to update the Capgo application to version 12.128.2 or later, where the transfer_app() function has been fixed to properly update the deploy_history.owner_org field during application transfers.

If updating is not immediately possible, a temporary workaround is to manually update the deploy_history.owner_org field in the database after transferring applications to ensure ownership consistency.

• Run an SQL update statement to synchronize deploy_history.owner_org with the current app owner_org, for example:
• UPDATE deploy_history dh SET owner_org = a.owner_org FROM public.apps a WHERE dh.app_id = a.id AND dh.owner_org != a.owner_org;

This ensures that deployment history ownership is correctly assigned, preventing unauthorized access or loss of access to deployment records.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in Capgo allows unauthorized access to deployment history records across organizational boundaries due to improper authorization in the transfer_app() function. This cross-organization data access and loss of proper access control can undermine data integrity and confidentiality.

Such issues can negatively impact compliance with standards and regulations like GDPR and HIPAA, which require strict access controls, data integrity, and auditability to protect sensitive information and ensure accountability.

Specifically, the flaw may break auditability of deployment progression and violate organizational boundary authorization expectations, which are critical for regulatory compliance.

Useful 0 Not Useful 0