CVE-2026-56333: Capgo Authentication Bypass in Security Settings – Patch 12.128.2

Technical summary

CVE-2026-56333 is a server-side validation bypass in Capgo's organization security settings. The vulnerability exists in the handling of the public.orgs table, where backend validation checks on security-sensitive parameters—specifically max_apikey_expiration_days and similar configuration fields—can be circumvented by authenticated organization admins. The flaw stems from insufficient client-side and database-level constraint enforcement, permitting direct table manipulation from the browser that bypasses application-layer validation logic. The issue affects authentication and authorization mechanisms by allowing admins to persist security policies in an invalid state.

Business impact

This vulnerability primarily affects organizations using Capgo for multi-tenant or team-based access control. The ability for authenticated admins to bypass API key expiration policies creates a secondary risk: if a compromised or malicious admin account modifies these settings, API keys could remain valid indefinitely, extending the window of exposure for stolen credentials. The impact is limited to users within the affected organization and depends on admin account compromise or insider threat scenarios. For organizations relying on Capgo for security policy enforcement, this represents a control weakness that undermines the intended security posture.

Affected systems

Capgo versions before 12.128.2 are affected. The vulnerability requires an authenticated organization admin account and impacts the security configuration settings for that organization. No evidence indicates that the vulnerability affects Capgo's core application functionality or other products in the vendor's portfolio; the exposure is isolated to the organization management layer.

Exploitability

Exploitation requires an authenticated account with organization admin privileges, which is a significant control. An attacker would need either to compromise a legitimate admin account, operate as a trusted insider, or target an organization where admin credentials are inadequately protected. Network access is required but straightforward (CVSS:3.1/AV:N). Once authenticated, the attack is deterministic—no user interaction is needed, and the attacker can directly modify database fields via the browser. The CVSS score of 4.3 reflects the authenticated requirement and the limited scope (integrity impact only, no confidentiality or availability breach).

Remediation

Upgrade Capgo to version 12.128.2 or later, which addresses server-side validation enforcement. The patch adds backend validation constraints that prevent invalid security policy states from being persisted, even when an authenticated user attempts direct database modification. Organizations should verify the upgrade path with Capgo's release notes and test in a staging environment before production deployment.

Patch guidance

Apply Capgo version 12.128.2 or any subsequent release. This version includes backend validation hardening for organization security settings. Verify compatibility with your current Capgo deployment and any dependent integrations. If you are currently on a version older than 12.128.2, prioritize an upgrade within your normal maintenance window. Review Capgo's official security advisory and release notes for any migration notes or breaking changes.

Detection guidance

Audit organization security configuration changes, particularly modifications to max_apikey_expiration_days and other sensitive fields in the public.orgs table. Log and alert on unauthorized updates to organization settings by admin accounts, especially if changes occur outside of normal administrative patterns. Monitor for API keys that remain active beyond expected expiration dates. Examine admin activity logs for unusual database access patterns or attempts to modify organization configuration via API or direct queries. Implement database activity monitoring to detect direct table modifications that circumvent the application layer.

Why prioritize this

While the CVSS score is MEDIUM (4.3), the vulnerability warrants timely attention because it directly undermines security policy enforcement—a core control in multi-tenant environments. The risk is elevated for organizations where admin account compromise is plausible or where insider threat is a concern. However, it is not critical because exploitation requires pre-existing admin access and does not enable remote code execution or widespread data compromise. Prioritize patching after critical and high-severity items, but do not defer indefinitely.

Risk score, explained

The CVSS 3.1 score of 4.3 (MEDIUM) reflects: authenticated access requirement (PR:L), network-accessible attack vector (AV:N), low attack complexity (AC:L), integrity impact (I:L) with no user interaction required, and a scope unchanged to the vulnerable system. The score appropriately penalizes the authentication requirement but acknowledges that an attacker with admin privileges can reliably bypass validation checks. The integrity impact is limited because the attacker can only persist invalid policy state, not exfiltrate data or disrupt availability.

Frequently asked questions