Scope Isolation Flaw in Capgo Products by Capgo

CVE-2026-56252

What is CVE-2026-56252?

A vulnerability has been identified in Capgo that allows app-scoped API keys to bypass security measures meant to limit access to organization-wide webhook operations. This flaw, found in the /webhooks/test endpoint, enables attackers with basic credentials to send unauthorized webhook deliveries, breaching the intended app boundary security. It is crucial for users of Capgo versions prior to 12.128.2 to take immediate action to mitigate potential exploitation.

References