CVE-2026-56079: Capgo Auth Bypass Vulnerability

CVE-2026-56079 Overview

CVE-2026-56079 is a cross-tenant authorization bypass vulnerability in Capgo versions prior to 12.128.2. The flaw resides in the application's PostgREST endpoints, where org-scoped read API keys fail to enforce tenant isolation. Attackers holding a valid read key for one organization can query the webhooks and webhook_deliveries endpoints and retrieve other tenants' HMAC signing secrets and delivery payloads. With stolen signing secrets, an attacker can forge authenticated webhook events targeting victim organizations. The vulnerability is classified as Information Exposure [CWE-200].

Critical Impact
An authenticated attacker with a low-privilege org-scoped read API key can exfiltrate HMAC webhook signing secrets across tenant boundaries and forge webhook events against any victim organization.

Affected Products

Capgo versions prior to 12.128.2
PostgREST webhooks endpoint
PostgREST webhook_deliveries endpoint

Discovery Timeline

2026-06-19 - CVE-2026-56079 published to NVD
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2026-56079

Vulnerability Analysis

The vulnerability stems from missing row-level authorization checks on PostgREST endpoints exposed by Capgo. PostgREST automatically generates REST APIs from PostgreSQL schemas. When tenant scoping is enforced via row-level security or filter predicates, missing policies expose all rows to any authenticated caller.

In Capgo, org-scoped read API keys are intended to authorize read access only within the issuing organization. The webhooks and webhook_deliveries tables lacked enforcement tying queries to the caller's organization identifier. As a result, a key issued to organization A returns rows belonging to organizations B, C, and beyond.

The exposed data includes HMAC signing secrets used to authenticate webhook deliveries and historical delivery payloads. Once the signing secret is known, the attacker computes valid signatures for crafted payloads. The downstream consumer treats those forged events as authentic, enabling impersonation of legitimate platform events.

Root Cause

The root cause is missing or incorrect tenant-scoping predicates on PostgREST resources. Authorization was enforced at the authentication layer but not at the data-access layer for the affected tables.

Attack Vector

The attack requires network access to the Capgo API and a valid org-scoped read API key, which any registered customer can obtain. The attacker issues HTTP GET requests against the webhooks and webhook_deliveries endpoints and parses returned secrets. No user interaction is required. Refer to the GitHub Security Advisory and the VulnCheck Advisory on Capgo for technical details.

Detection Methods for CVE-2026-56079

Indicators of Compromise

Unexpected GET requests to /webhooks or /webhook_deliveries PostgREST endpoints originating from API keys that do not own the returned rows.
Webhook delivery events received by downstream consumers with valid HMAC signatures but anomalous payloads, source IPs, or timing.
API key usage patterns showing one key enumerating large result sets across many organization identifiers.

Detection Strategies

Audit PostgREST access logs for requests to webhooks and webhook_deliveries and correlate the requesting API key's organization with the organization identifier in returned rows.
Alert on bulk reads or high-volume pagination against tables containing tenant secrets.
Compare downstream webhook consumer logs against Capgo's authoritative delivery log to identify forged events without corresponding upstream sends.

Monitoring Recommendations

Centralize PostgREST and API gateway logs and apply per-tenant baselines for read volume on sensitive tables.
Monitor for rotation events and reuse of HMAC signing secrets across deliveries.
Track read API key behavior for cross-tenant access anomalies and revoke keys exhibiting enumeration patterns.

How to Mitigate CVE-2026-56079

Immediate Actions Required

Upgrade Capgo to version 12.128.2 or later, which adds tenant-scoping enforcement on the affected PostgREST endpoints.
Rotate all HMAC webhook signing secrets, as any value exposed before the upgrade must be considered compromised.
Revoke and reissue org-scoped read API keys to invalidate access tokens that may have been used for exfiltration.

Patch Information

The fix is delivered in Capgo 12.128.2. The patch enforces tenant scoping on the webhooks and webhook_deliveries PostgREST endpoints so that org-scoped read keys can only access rows owned by their issuing organization. See the GitHub Security Advisory for upgrade instructions.

Workarounds

Restrict network access to PostgREST endpoints to trusted clients until the upgrade is applied.
Disable issuance of org-scoped read API keys, or limit their permissions to exclude webhook-related tables.
Add PostgreSQL row-level security policies on the webhooks and webhook_deliveries tables that filter by the authenticated organization claim.

bash

# Verify installed Capgo version and upgrade
npm list @capgo/capgo
npm install @capgo/capgo@^12.128.2