CVE-2026-56335 Capgo - Channel Configuration Mutation via Write-Scoped API Keys
Attackers with write-scoped API keys can bypass authorization checks to modify sensitive channel configuration fields in Capgo.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-56335?
CVE-2026-56335 is a high-severity missing authorization vulnerability in Capgo, published on 10 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Capgo before 12.128.2 contains an authorization bypass vulnerability where write-scoped API keys can directly mutate protected channel configuration fields through PostgREST by exploiting a null authentication check in the immutability trigger. Attackers with write API keys can modify sensitive channel attributes such as public, allow_emulator, and security-related flags outside intended application routes.
Weakness: CWE-284
Which versions are affected by CVE-2026-56335?
How do I fix CVE-2026-56335?
No fix has been published for CVE-2026-56335 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-56335 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-56335 exists.
Sources
Also known as GHSA-648m-f972-jcc9, GHSA-ph9c-vwjq-pqhj.