CVE-2026-56222: Capgo Authorization Bypass Vulnerability

CVE-2026-56222 Overview

CVE-2026-56222 is an authorization bypass vulnerability in Capgo versions prior to 12.128.2. The flaw resides in the POST /private/role_bindings endpoint, which fails to verify app_id ownership during app-scoped role binding creation. An attacker holding administrative privileges in one organization can create role bindings that target applications owned by other organizations. This results in unauthorized read and modification access to victim applications across tenant boundaries. The vulnerability is classified under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact
Cross-organization application takeover allowing attackers with administrative access in any tenant to read and modify applications owned by other organizations.

Affected Products

Capgo versions before 12.128.2
Self-hosted Capgo deployments exposing the /private/role_bindings endpoint
Multi-tenant Capgo instances serving multiple organizations

Discovery Timeline

2026-06-23 - CVE-2026-56222 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-56222

Vulnerability Analysis

The vulnerability stems from a missing ownership check in Capgo's role binding creation endpoint. When a client submits a POST request to /private/role_bindings, the server accepts an app_id parameter alongside the org_id context of the authenticated administrator. The backend confirms that the requester holds administrative privileges within the supplied org_id but does not validate that the referenced app_id actually belongs to that organization. This mismatch between authentication scope and authorization scope enables tenant boundary violations.

An attacker who controls any organization on a shared Capgo instance can supply the app_id of a victim organization's application. The server creates the role binding without rejecting the cross-tenant reference. The attacker then gains the bound role's permissions over the targeted application, including read access to source bundles and modification rights over update channels.

Root Cause

The root cause is an Insecure Direct Object Reference (IDOR) condition in the role binding handler. The endpoint trusts user-supplied identifiers without enforcing that the app_id belongs to the same organization as the authenticated principal. No relational integrity check joins app_id against the caller's org_id prior to insertion.

Attack Vector

Exploitation requires network access to the Capgo API and administrative credentials in any organization on the target instance. The attacker issues a crafted POST /private/role_bindings request containing their own org_id and a victim organization's app_id. No user interaction is required on the victim side. Refer to the GitHub Security Advisory GHSA-5r52-m8r9-7f8x and the VulnCheck Advisory for additional context.

Detection Methods for CVE-2026-56222

Indicators of Compromise

POST /private/role_bindings requests where the supplied app_id does not resolve to an application owned by the caller's org_id
New role binding records linking principals from one organization to applications owned by another
Unexpected read or write operations against application bundles originating from accounts outside the owning organization
Audit log entries showing role binding creation immediately followed by access to previously untouched applications

Detection Strategies

Query the role bindings table for rows where the bound principal's organization differs from the target application's organization
Correlate API access logs to identify administrators acting on applications outside their declared tenant scope
Implement server-side assertions during audit review that reject any mismatch between org_id and app_id ownership

Monitoring Recommendations

Forward Capgo API access logs and database audit trails to a centralized logging platform for cross-tenant analysis
Alert on the first occurrence of any administrator accessing applications outside their home organization
Track creation rates of role bindings per organization to flag anomalous spikes that may indicate automated abuse

How to Mitigate CVE-2026-56222

Immediate Actions Required

Upgrade Capgo to version 12.128.2 or later on all instances
Audit existing role bindings to identify any that link principals across organizational boundaries and revoke them
Rotate API credentials and review administrative account membership in every organization on shared instances
Inspect application update channels and bundles for unauthorized modifications introduced via the bypass

Patch Information

Capgo 12.128.2 introduces server-side validation that verifies the supplied app_id belongs to the same organization as the authenticated administrator before creating a role binding. Operators of self-hosted deployments should pull the patched release and restart the API service. See the GitHub Security Advisory GHSA-5r52-m8r9-7f8x for full release details.

Workarounds

Restrict access to the /private/role_bindings endpoint at the reverse proxy or API gateway until the patch is applied
Temporarily disable creation of app-scoped role bindings through administrative tooling
Enforce manual review of all new role binding requests on multi-tenant instances

bash

# Example nginx rule to block the vulnerable endpoint until patched
location = /private/role_bindings {
    if ($request_method = POST) {
        return 403;
    }
}