CVE-2026-56283: Capgo HTML Injection in Organization Settings (CVSS 5.4)

Technical summary

This vulnerability is a reflected or stored HTML injection (CWE-79) in Capgo's organization settings endpoint. The application fails to properly sanitize user input in the organization name field before rendering it in the HTML response. An attacker with a valid account can craft payloads using standard HTML tags and attributes (such as <script>, <iframe>, or <img> with event handlers) to execute arbitrary client-side actions. The CVSS 3.1 score of 5.4 (MEDIUM) reflects the need for prior authentication and user interaction, combined with limited scope and moderate impact on confidentiality and integrity.

Business impact

Organizations using Capgo face several risks: employees could be redirected to credential-harvesting sites mimicking legitimate services, leading to account compromise; attackers could deface the organization's settings interface, damaging trust; and the attack could serve as a stepping stone for social engineering or lateral movement within the platform. The impact is amplified in multi-team environments where settings changes are visible to many users, potentially affecting team productivity and creating support burden for incident response.

Affected systems

Capgo versions before 12.128.2 are affected. Organizations running Capgo should verify their current deployment version immediately. The vendor has released a patched version; confirm your deployment version against Capgo's release notes to determine if an upgrade is needed.

Exploitability

Exploitation requires a valid Capgo account (authentication), limiting the threat to insider threats or compromised accounts. An attacker must craft a malicious payload in the organization name field and then trick or wait for another user to visit the organization settings page. This combination of requirements—valid credentials plus user interaction—places this in the 'low to moderate' exploitability range. The attack is straightforward to execute once access is obtained, with no complex technical barriers.

Remediation

Upgrade Capgo to version 12.128.2 or later, which contains input validation and output encoding fixes to prevent HTML injection. Verify the upgrade by checking the running version in your Capgo deployment. If immediate patching is not feasible, restrict organization settings access to a minimal set of trusted administrators and monitor for suspicious organization name changes.

Patch guidance

Apply the Capgo update to version 12.128.2 or later as soon as practicable. Follow your standard change management process, including testing in a non-production environment if available. No special configuration changes are required post-patch. Verify the upgrade by confirming the version string in the Capgo admin interface or logs. If you are running Capgo in a containerized environment, ensure you pull the latest image tag or specify version 12.128.2+ in your deployment manifest.

Detection guidance

Monitor for suspicious changes to organization names that contain HTML tags or script-like syntax (look for patterns such as <, >, script, iframe, onerror, onload). Review audit logs for organization setting modifications by accounts with unusual access patterns. Check web proxy or WAF logs for requests to the organization settings endpoint with encoded or obfuscated HTML payloads. If you have access to Capgo's request logs, search for organization name parameters containing HTML metacharacters or event handler attributes.

Why prioritize this

This vulnerability merits prompt but not emergency remediation. The MEDIUM severity reflects the requirement for prior authentication and user interaction, which limits widespread exploitation risk. However, the attack surface in a collaborative platform like Capgo—where settings are shared and visible across teams—and the social engineering potential warrant prioritizing this above lower-severity issues. Organizations with many Capgo users or high-privilege accounts should patch sooner; smaller or isolated deployments can follow standard patching windows.

Risk score, explained

The CVSS 3.1 score of 5.4 (MEDIUM, AV:N/AC:L/PR:L/UI:R/S:C) reflects: network-accessible endpoint (AV:N), low attack complexity (AC:L), requirement for valid credentials (PR:L), and dependence on user interaction (UI:R). The changed scope (S:C) indicates the impact can affect resources beyond the security scope of the vulnerable component. Limited impact on confidentiality and integrity (C:L/I:L) and no availability impact (A:N) place this in the moderate range rather than high.

Frequently asked questions