Capgo - Cross-Tenant Authorization Bypass via PostgREST Webhook Access | Advisories

Advisories

Capgo - Cross-Tenant Authorization Bypass via PostgREST Webhook Access

severity: medium
date: 6/19/2026
Affecting: Capgo >= 0, < 12.128.2
CVE: CVE-2026-56079
CWE: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CVSS: 7.1
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
References: GHSA Advisory GHSA-hj3h-v877-g5rx
Credit: Judel777
Description: Capgo before 12.128.2 contains a cross-tenant authorization bypass vulnerability in PostgREST endpoints that allows org-scoped read API keys to access other tenants' webhook secrets and delivery logs. Attackers can query the webhooks and webhook_deliveries endpoints to exfiltrate HMAC signing secrets and delivery payloads, enabling forged webhook events against victim organizations.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.

Vulnerability Prioritization
Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
Early Warning System
Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

Schedule a Demo