Vulnerability Description
Capgo before 12.128.2 contains an authorization flaw in POST /private/create_device that accepts a caller-supplied org_id parameter without validating it matches the target app's owner organization. Authenticated attackers can create device records for an application using a foreign organization identifier, bypassing the intended org/app authorization boundary.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/Cap-go/capgo/security/advisories/GHSA-mhrc-qhq8-872f
- https://www.vulncheck.com/advisories/capgo-org-app-scope-mismatch-in-device-crea
- https://github.com/Cap-go/capgo/security/advisories/GHSA-mhrc-qhq8-872f
FAQ
What is CVE-2026-56320?
CVE-2026-56320 is a vulnerability with a CVSS score of 7.1 (HIGH). Capgo before 12.128.2 contains an authorization flaw in POST /private/create_device that accepts a caller-supplied org_id parameter without validating it matches the target app's owner organization. A...
How severe is CVE-2026-56320?
CVE-2026-56320 has been rated HIGH with a CVSS base score of 7.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-56320?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.