CVE-2026-56335: Capgo API Authorization Bypass – Channel Configuration Exploitation

Technical summary

CVE-2026-56335 is an authorization bypass in Capgo's PostgREST integration that allows write-scoped API keys to mutate immutable channel configuration fields. The root cause is a null authentication check in the immutability trigger—a database-level constraint designed to prevent modification of protected attributes. An attacker with valid write credentials can craft direct database requests that bypass application-layer validation and modify fields such as 'public', 'allow_emulator', and security-related flags. This is classified under CWE-284 (Improper Access Control / Permissions) and does not require user interaction. The CVSS 3.1 score of 6.5 (MEDIUM) reflects the high integrity impact but requires authenticated API access to exploit.

Business impact

Organizations using Capgo may experience unauthorized modification of critical channel configurations, potentially leading to unintended public exposure of services, activation of emulator support when disabled for security, or manipulation of other security-related flags. This could compromise the intended isolation and access controls of the application's deployment channels. Since exploitation requires valid API credentials, the risk is elevated in environments with poor API key hygiene or where keys have been compromised or shared inappropriately. Depending on what channel settings control, this could affect deployment integrity or feature availability.

Affected systems

Capgo versions prior to 12.128.2 are vulnerable. The source data does not enumerate specific vendor/product classifications beyond Capgo itself, so organizations should verify their installed version against the Capgo release notes and security advisories to determine exact exposure. All instances of affected Capgo versions should be considered in scope.

Exploitability

Exploitation requires network access and possession of a valid write-scoped API key. An attacker with these credentials can directly invoke PostgREST mutations without needing to go through the application's intended authorization routes. The flaw is a logic error in a database trigger, making it exploitable without complex tooling—a simple HTTP request to the PostgREST endpoint with authenticated credentials can trigger the bypass. There is no known public exploit code or CISA KEV listing at this time. The barrier to exploitation is moderate: while it requires authentication, the flaw is straightforward and does not require interaction or special timing.

Remediation

Upgrade Capgo to version 12.128.2 or later. This version patches the null authentication check in the immutability trigger, restoring proper authorization enforcement. Before patching, limit API key distribution, rotate keys that may have been exposed, and audit recent API logs for suspicious mutations to protected channel fields. Implement network-level controls to restrict direct PostgREST access if possible, forcing requests through application validation layers.

Patch guidance

Deploy Capgo 12.128.2 or later as soon as feasible. Review the Capgo release notes and security advisory at https://capgo.app (or your distribution source) to confirm the patch contents and any configuration changes required. Test the upgrade in a non-production environment first to ensure compatibility with your application. Verify via version checks that the patch has been applied: `capgo --version` or equivalent depending on your deployment method. If you are on an older version, also check for any intermediate security patches or breaking changes in the release history.

Detection guidance

Monitor API audit logs for write requests targeting channel configuration fields (public, allow_emulator, security flags) that originate from unexpected IP addresses, API keys, or service accounts. Look for direct PostgREST mutations that bypass application routes or show null values in authentication contexts. Inspect PostgREST request patterns and correlate with database trigger logs to identify attempts to exploit the null-check flaw. If your organization has exported or shared API keys widely, prioritize rotation and audit logs associated with those credentials. Consider setting alerts on changes to sensitive channel attributes outside normal deployment workflows.

Why prioritize this

Although scored MEDIUM in CVSS, this vulnerability should be prioritized for patching because it enables full mutation of security-relevant configuration with only authenticated write access. The integrity impact is high—an attacker can silently alter deployment settings in ways that undermine security posture or bypass intended controls. The fact that exploitation does not require user interaction and can be triggered programmatically makes it a reliable attack vector if credentials are leaked or misused. Organizations should treat this as a standard patch cycle priority, not low-priority maintenance.

Risk score, explained

The CVSS 3.1 score of 6.5 (MEDIUM) reflects: (1) Network accessibility (AV:N) at no special requirement, (2) Low attack complexity (AC:L) since the flaw is a straightforward logic error, (3) Low privileges required (PR:L) because a valid write API key is sufficient, (4) No user interaction (UI:N), (5) Unchanged scope (S:U), (6) No confidentiality impact (C:N), and (7) High integrity impact (I:H) because protected channel fields can be freely modified. The score is not elevated to 'high' because the vulnerability does require pre-existing authentication; however, the high integrity impact and ease of exploitation justify urgent attention within your patch schedule.

Frequently asked questions