Authorization Bypass in Capgo Webhook Management by Non-Expiring API Keys

CVE-2026-56295

What is CVE-2026-56295?

The Capgo platform prior to version 12.128.2 is susceptible to an authorization bypass vulnerability in its webhook management endpoints. This flaw permits attackers with non-expiring API keys to circumvent the organization's policy on key expiration, effectively allowing them to list, create, and delete webhooks. The checkWebhookPermission function does not correctly invoke the apikeyHasOrgRightWithPolicy check, resulting in a security loophole that undermines the intended organizational controls over webhook management.

References