Server-Side Request Forgery Vulnerability in Capgo by Capgo
CVE-2026-56227

5.3MEDIUM

Key Information:

Vendor

Capgo

Status
Capgo
Vendor
CVE Published:
20 June 2026

What is CVE-2026-56227?

A server-side request forgery (SSRF) vulnerability exists in Capgo prior to version 12.128.2 due to insecure webhook URL validation. This flaw allows organization administrators to configure webhooks that point to localhost or internal addresses, which the backend may access. When these webhooks are triggered, it can lead to the server making outbound requests to sensitive internal resources, potentially exposing error responses to unauthorized users. This presents a significant risk of information disclosure and unauthorized access within protected internal environments.

Affected Version(s)

Capgo 0 < 12.128.2

Capgo 12.128.2

References

https://github.com/Cap-go/capgo/security/advisories/GHSA-...
vendor-advisory
https://www.vulncheck.com/advisories/capgo-server-side-re...
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Judel777
.