CVE-2026-56079: Capgo Cross-Tenant Authorization Bypass in Webhook Endpoints

Technical summary

The vulnerability exists in PostgREST endpoints within Capgo's API layer. Org-scoped read API keys lack proper cross-tenant authorization checks when querying the webhooks and webhook_deliveries tables. An authenticated attacker can construct queries against these endpoints to enumerate and retrieve webhook configurations and delivery history from organizations other than the one their API key is scoped to. The HMAC signing secrets stored in the webhooks table become directly accessible, and the webhook_deliveries table exposes the actual payloads and metadata of webhook events sent to third parties. This represents a fundamental tenant isolation bypass (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor).

Business impact

Organizations using Capgo face potential compromise of webhook authentication mechanisms. An attacker with a valid but minimally-privileged API key can obtain the cryptographic material needed to forge webhook requests, enabling them to trigger unauthorized actions in downstream systems that rely on Capgo's webhooks (CI/CD pipelines, monitoring alerts, compliance systems, etc.). The exposure is limited to organizations sharing the same Capgo instance; however, the ability to craft valid HMAC signatures means the forged events would pass signature verification in victim systems. This can lead to unauthorized deployments, alert suppression, data exfiltration, or system state changes depending on what integrations consume the webhooks.

Affected systems

All Capgo deployments before version 12.128.2 are affected. Capgo's PostgREST API endpoints are exposed to any authenticated user holding an org-scoped read API key. The vulnerability requires an attacker to have legitimate API credentials (obtained through account compromise, insider access, or supply chain access), making it a post-authentication attack. Self-hosted and SaaS deployments of Capgo are both impacted.

Exploitability

Exploitability is moderate. The attack requires a valid Capgo API key with org-scoped read permissions—a commonly issued credential type for integrations and CI/CD pipelines. Once obtained, exploitation is straightforward: standard HTTP queries to the webhooks and webhook_deliveries endpoints retrieve the sensitive data without additional complexity. No user interaction is required, and the attack leaves minimal forensic traces if logging is not comprehensive. However, the attacker must first obtain valid API credentials, which typically requires account compromise or supply chain access.

Remediation

Immediately upgrade Capgo to version 12.128.2 or later. This version includes authorization controls that enforce tenant isolation in the PostgREST endpoints, ensuring read API keys can only access webhook data for their scoped organization. Review all API keys currently in use and rotate any that may have been exposed or used in untrusted environments. Audit webhook delivery logs for any suspicious activity during the period when vulnerability exposure was possible, and consider rotating HMAC signing secrets for all webhooks after patching.

Patch guidance

Update Capgo to version 12.128.2 or later. The patch implements server-side authorization checks in the PostgREST layer to validate that API key organization scope matches the organization of the requested webhook resources. Verify against the vendor advisory and release notes that the patched version includes fixes for cross-tenant authorization in webhook endpoints. Plan patching immediately for production instances, as the vulnerability enables direct credential theft without requiring additional exploitation steps. Staging environments should be patched first to verify no integration breakage occurs.

Detection guidance

Monitor API access logs for suspicious patterns: repeated queries to the webhooks and webhook_deliveries endpoints by API keys that do not match the organization ID in the requested resources, or API keys making requests outside their configured scope. Look for queries that retrieve large volumes of webhook configuration data or delivery logs in a short timeframe. If your Capgo instance logs PostgREST query patterns, alert on cross-organization access attempts. Review CloudTrail or equivalent logs if Capgo is deployed on a cloud platform. Check for unauthorized HMAC secret exfiltration by monitoring downstream systems for forged or anomalous webhook events with valid signatures originating from unexpected sources.

Why prioritize this

Patch this vulnerability promptly despite its CVSS 6.5 (MEDIUM) score. The actual business impact is high because webhook secrets are cryptographic material that, once compromised, enable long-term forged events against downstream systems. The fix is simple (a version upgrade) and should be low-risk. The vulnerability requires prior API key compromise but is trivial to exploit once that occurs. Organizations relying on Capgo webhooks for critical automation (deployment pipelines, financial transactions, compliance alerts) should prioritize patching within their standard update cycle, ideally within 2–4 weeks.

Risk score, explained

CVSS 6.5 reflects that the vulnerability requires authenticated access (PR:L), impacts confidentiality only (C:H/I:N), and cannot directly cause availability impact (A:N). The score appropriately captures that this is a post-authentication information disclosure. However, the real-world risk is elevated because the disclosed information (HMAC secrets) directly enables downstream attacks. Organizations should consider the business context of their webhook integrations when prioritizing: financial or deployment-critical webhooks warrant faster patching than informational webhooks.

Frequently asked questions