CVE-2026-56320: Capgo Authorization Bypass in Device Creation (CVSS 7.1)

Technical summary

CVE-2026-56320 is an authorization bypass vulnerability in Capgo's POST /private/create_device endpoint. The flaw stems from insufficient validation of the caller-supplied org_id parameter. The endpoint accepts any org_id value without confirming that it corresponds to the authenticated user's organization or that it matches the organization owning the target application. This violation of the principle of least privilege (CWE-285: Improper Authorization) allows an authenticated attacker to create device records associated with arbitrary organizations, circumventing the intended org/app ownership boundary. The CVSS 3.1 score of 7.1 reflects the combination of network accessibility, low attack complexity, and significant integrity impact, though confidentiality impact is limited.

Business impact

Unauthorized device creation within a Capgo instance can lead to data integrity compromise and operational confusion. An attacker could inject fabricated device records into competitor or partner applications, potentially affecting analytics, compliance reporting, and device management workflows. The ability to claim devices under foreign organizations may also enable reconnaissance or service disruption if downstream integrations rely on device records for authentication or resource allocation.

Affected systems

Capgo versions prior to 12.128.2 are affected. Organizations running Capgo in multi-tenant or multi-organization environments face elevated risk, particularly if user roles and API tokens are widely distributed. The vulnerability requires authentication, so it is not exploitable by anonymous users.

Exploitability

Exploitation requires valid Capgo credentials. An authenticated user (legitimate or compromised account) can craft a POST request to /private/create_device with a foreign org_id to bypass authorization checks. No user interaction or special conditions are needed once authentication is obtained. The low attack complexity and straightforward request structure make exploitation trivial for anyone with account access. The vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, but the ease of exploitation warrants prompt remediation.

Remediation

Upgrade Capgo to version 12.128.2 or later. This patch implements proper validation of the org_id parameter, ensuring that it matches the organization of the authenticated user and the target application before allowing device record creation. Organizations should verify the patch is deployed across all Capgo instances and test device creation workflows in both single and multi-tenant configurations.

Patch guidance

Apply Capgo version 12.128.2 or newer as soon as feasible. Review your Capgo deployment architecture to identify whether you operate single or multi-organization instances. Test the patched version in a non-production environment to confirm that legitimate device creation workflows continue to function correctly. If you cannot patch immediately, consider restricting API token distribution and monitoring device creation logs for unusual patterns (e.g., devices created with org_ids not matching the caller's organization).

Detection guidance

Monitor POST requests to /private/create_device endpoints. Flag or investigate instances where the org_id parameter in the request does not match the authenticated user's organization or the target application's owner organization. Review device creation audit logs for the period before patching to identify any unauthorized device records. Alert on API calls from service accounts or user roles with broader permissions than expected. Consider implementing request validation at the API gateway or proxy layer as a defense-in-depth measure.

Why prioritize this

Although the CVSS score is 7.1 (HIGH) and the vulnerability does not yet appear on the CISA KEV list, it should be treated as high priority because it enables cross-organizational data tampering in a configuration or orchestration platform. Multi-tenant Capgo deployments are particularly at risk. The ease of exploitation—requiring only valid credentials and a standard HTTP POST—combined with the direct integrity impact on application configurations justifies rapid patching.

Risk score, explained

The CVSS 3.1 score of 7.1 reflects: (1) network-accessible endpoint (AV:N), (2) low attack complexity—no special conditions needed beyond authentication (AC:L), (3) requirement for prior authentication (PR:L), (4) limited scope (S:U), (5) low confidentiality impact (C:L), and (6) high integrity impact from unauthorized device record creation (I:H). The absence of availability impact (A:N) prevents a critical rating. The score appropriately balances the ease of exploitation against its limited scope within the application layer.

Frequently asked questions