CVE-2026-56295 Capgo - Policy Enforcement Bypass in Webhook Management Endpoints via Non-Expiring API Keys
Attackers with legacy non-expiring API keys can bypass organizational expiration policies to manage webhooks in Capgo.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-56295?
CVE-2026-56295 is a medium-severity missing authorization vulnerability in Capgo, published on 20 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Capgo before 12.128.2 contains an authorization bypass vulnerability in webhook management endpoints that allows non-expiring API keys to bypass the require_apikey_expiration organization policy. The checkWebhookPermission function fails to call apikeyHasOrgRightWithPolicy, enabling attackers with legacy non-expiring keys to list, create, and delete webhooks despite explicit organizational policy requiring key expiration.
Weakness: CWE-285
Which versions are affected by CVE-2026-56295?
How do I fix CVE-2026-56295?
No fix has been published for CVE-2026-56295 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-56295 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-56295 exists.
Sources
Also known as GHSA-99cw-mv92-985v, GHSA-vwpp-cqv5-cmfm.