CVE-2026-56241 Capgo - RBAC Demotion Privilege Retention via Stale org_users.user_right
Demoted super_admin users retain unauthorized access to delete and enumerate non-compliant bundles due to stale role data, allowing persistent privilege abuse.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-56241?
CVE-2026-56241 is a high-severity vulnerability in Capgo, published on 12 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Capgo before 12.128.2 contains a privilege escalation vulnerability where demoted super_admin users retain access to delete_non_compliant_bundles and count_non_compliant_bundles RPCs due to stale org_users.user_right column not being cleared during role binding deletion. Attackers can exploit this by maintaining a previously granted super_admin role to enumerate and bulk delete non-compliant bundles across the entire organization indefinitely.
Weakness: CWE-285
Which versions are affected by CVE-2026-56241?
How do I fix CVE-2026-56241?
No fix has been published for CVE-2026-56241 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-56241 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-56241 exists.
Sources
Also known as GHSA-rvvc-rvxv-qcrh, GHSA-v7q8-55qw-h6hr.