CVE-2026-56222: Capgo Authorization Bypass Affecting Multi-Tenant Role Bindings

Technical summary

CVE-2026-56222 is an authorization bypass vulnerability in Capgo's role binding creation mechanism. The POST /private/role_bindings endpoint does not perform adequate verification of app_id ownership before creating app-scoped role bindings. An authenticated attacker holding administrative privileges in one organization context can craft requests to bind roles to applications owned by other organizations, circumventing the intended access control boundary. The vulnerability stems from insufficient authorization checks (CWE-639: Authorization through User-Controlled Key) and affects the confidentiality, integrity, and availability of cross-organization applications.

Business impact

Organizations running Capgo can face cross-tenant data exposure and unauthorized modification of production applications. An attacker with admin credentials in one tenant could read sensitive application configurations, secrets, or code from unrelated organizations' applications, or modify them to introduce backdoors or trigger service degradation. In multi-tenant deployments, this represents a severe isolation breach that could affect compliance, customer trust, and operational security.

Affected systems

Capgo versions prior to 12.128.2 are vulnerable. Organizations should verify their deployment version immediately. The vulnerability is present in the role binding creation functionality and impacts any Capgo instance where multiple organizations share the same platform infrastructure.

Exploitability

Exploitation requires valid administrative credentials within a Capgo organization; it cannot be executed by unauthenticated users. The attack surface is restricted to users with existing privileged access. However, the barrier to exploitation is low once admin credentials are obtained—no complex techniques, user interaction, or host-level access are required. The network-accessible endpoint and straightforward request-response nature make this a practical risk for compromised admin accounts or insider threats.

Remediation

Upgrade Capgo to version 12.128.2 or later. This patch introduces proper ownership verification for app_id parameters in role binding creation, ensuring administrators can only bind roles to applications within their own organization. Prior to upgrading, restrict administrative access in Capgo to trusted personnel and monitor role binding activities for anomalies.

Patch guidance

Apply the 12.128.2 release or any subsequent patched version from the Capgo vendor. Verify the patch deployment by confirming the version number in your Capgo instance (typically accessible via CLI or admin dashboard). Test in a staging environment first if possible to ensure no integration breakage with existing role binding configurations. Consider re-auditing active role bindings after patching to detect any unauthorized bindings created during the vulnerability window.

Detection guidance

Monitor POST requests to /private/role_bindings for suspicious patterns: requests from admin accounts binding roles to app_ids outside their organization, role binding creation for applications the requester should not have visibility into, or unusual spikes in role binding API calls. Log and review the app_id and organization_id combinations in role binding audit trails. Implement alerts for cross-organization role binding attempts. Check Capgo audit logs for the creation timestamp of role bindings and correlate with known admin account activity.

Why prioritize this

HIGH priority. The vulnerability enables cross-organization privilege escalation with moderate exploitation barriers (requires existing admin credentials) but severe impact (read and write access to victim applications and data). The CVSS 7.2 score reflects high confidentiality and integrity impact. Organizations with multiple tenants or high-value applications should patch immediately. Those with strong credential hygiene and limited admin account distribution can accept brief delays, but this should not remain unpatched beyond routine maintenance windows.

Risk score, explained

CVSS 3.1 score of 7.2 (HIGH) reflects: Network-accessible endpoint (AV:N), low attack complexity (AC:L), high privilege requirement as a limiting factor (PR:H), no user interaction needed (UI:N), single security boundary affected (S:U), and high impact across confidentiality, integrity, and availability (C:H/I:H/A:H). The 'High' privilege requirement prevents widespread abuse but does not reduce severity—an attacker who obtains admin credentials can immediately compromise other organizations' data.

Frequently asked questions