Server-Side Validation Bypass in Capgo Affects Organization Security Settings

CVE-2026-56333

What is CVE-2026-56333?

The Capgo platform prior to version 12.128.2 is affected by a server-side validation bypass vulnerability within the organization security settings. This flaw allows authenticated organization administrators to unintentionally maintain an invalid security policy state. By directly manipulating the public.orgs table through browser requests, attackers can evade critical backend validations, such as checks on max_apikey_expiration_days. This can potentially lead to unauthorized modifications of security-sensitive configuration parameters, posing significant risks to the integrity of organizational security.

References