CVE-2026-56240: Capgo Billing Auth Bypass Vulnerability

CVE-2026-56240 Overview

CVE-2026-56240 is an authorization bypass vulnerability in Capgo versions before 12.128.12. The flaw resides in the plan_valid calculation logic, which diverges from the authoritative billing gate. Organizations with exhausted or expired usage credit grants can continue accessing protected endpoints after credit depletion. Affected endpoints include /updates, /stats, /channel_self, and attachment upload routes. The issue is classified under CWE-285: Improper Authorization.

Critical Impact
Authenticated organizations can bypass billing enforcement and continue consuming paid services after their usage credits are exhausted or expired, resulting in unauthorized resource consumption.

Affected Products

Capgo versions prior to 12.128.12
Capgo self-hosted deployments using the vulnerable plan_valid hot-path
Capgo plugin integrations relying on the divergent authorization check

Discovery Timeline

2026-07-11 - CVE-2026-56240 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-56240

Vulnerability Analysis

The vulnerability is a business logic flaw in Capgo's billing enforcement layer. Capgo maintains two separate mechanisms for validating whether an organization can access paid features. The plugin hot-path evaluates a plan_valid expression to authorize requests quickly. A separate authoritative billing gate performs the definitive credit validation. These two paths diverge when usage credit grants are exhausted or expired.

Attackers with valid low-privilege credentials can exploit this divergence. The hot-path continues to return a valid plan state while the billing gate would otherwise deny access. This allows continued consumption of paid endpoints without valid credit. Impacted routes include update delivery, statistics collection, channel self-service operations, and attachment uploads.

The attack requires network access and authenticated organizational context. It does not require user interaction. The scope of impact is limited to service consumption rather than data confidentiality or system integrity.

Root Cause

The root cause is inconsistent authorization logic between two enforcement points. The plan_valid expression used in the plugin hot-path does not correctly account for exhausted or expired credit grants. The authoritative billing gate applies stricter validation. This inconsistency creates a bypass window when credits are depleted but the plan record still exists.

Attack Vector

An attacker with authenticated access to a Capgo organization deliberately consumes usage credits until exhaustion or waits for grant expiration. The attacker continues issuing requests to /updates, /stats, /channel_self, and attachment upload endpoints. The hot-path authorization returns success based on the divergent plan_valid calculation. Requests succeed despite the organization no longer being entitled to service.

No verified proof-of-concept code is publicly available. Refer to the VulnCheck Advisory on Authorization Bypass and the GitHub Security Advisory for technical details.

Detection Methods for CVE-2026-56240

Indicators of Compromise

Continued successful HTTP responses on /updates, /stats, /channel_self, and attachment upload endpoints for organizations whose credit grants show as exhausted or expired in billing records.
Discrepancies between plugin hot-path authorization logs and billing gate audit logs for the same organization identifier.
Sustained API traffic from tenants whose subscription state indicates no remaining paid entitlement.

Detection Strategies

Reconcile billing gate decisions against plugin hot-path authorization outcomes on a scheduled basis and alert on divergence.
Instrument the plan_valid code path to emit telemetry each time an expired or exhausted credit grant produces a positive authorization result.
Correlate organization-level usage metrics with credit balance state to identify tenants operating past their entitlement.

Monitoring Recommendations

Ingest Capgo application and billing logs into a centralized data lake for cross-source correlation and OCSF-normalized analysis.
Build dashboards tracking request volume per organization against remaining credit balance to visualize bypass attempts.
Alert on any authenticated request to protected endpoints where the associated tenant has a non-positive credit balance.

How to Mitigate CVE-2026-56240

Immediate Actions Required

Upgrade Capgo to version 12.128.12 or later, where the plan_valid calculation is aligned with the authoritative billing gate.
Audit organization accounts for anomalous usage after credit depletion and reconcile billing records.
Review access logs for the /updates, /stats, /channel_self, and attachment upload endpoints since the vulnerable version was deployed.

Patch Information

Upgrade to Capgo version 12.128.12 or later. The fix consolidates authorization logic so that the plugin hot-path and the billing gate produce consistent results when credit grants are exhausted or expired. See the GitHub Security Advisory GHSA-g9fc-82c2-p2r6 for the official vendor guidance.

Workarounds

Enforce the authoritative billing gate as a mandatory middleware in front of /updates, /stats, /channel_self, and attachment upload routes until the patch is applied.
Implement compensating controls such as rate limiting or hard usage caps at the reverse proxy layer for organizations with depleted credits.
Temporarily disable affected endpoints for tenants whose credit grants have expired if patching cannot be performed immediately.

bash

# Verify installed Capgo version and upgrade
npm list @capgo/capacitor-updater
npm install @capgo/capacitor-updater@^12.128.12