CVE-2026-56252: Capgo Auth Bypass Vulnerability

CVE-2026-56252 Overview

CVE-2026-56252 is a scope isolation vulnerability in Capgo versions prior to 12.128.2. The flaw exists in the POST /webhooks/test endpoint, which fails to enforce the limited_to_apps authorization check. Attackers holding app-scoped API keys can invoke org-scoped webhook operations that fall outside their declared application boundary. This allows them to trigger signed outbound webhook deliveries for arbitrary organization webhooks. The issue is classified under [CWE-863] (Incorrect Authorization) and stems from a broken access control decision at the endpoint layer.

Critical Impact
App-scoped credentials can trigger signed webhook deliveries for arbitrary organization webhooks, breaking tenant boundary enforcement and enabling abuse of trusted outbound integrations.

Affected Products

Capgo versions before 12.128.2
The POST /webhooks/test endpoint in the Capgo backend
Deployments relying on limited_to_apps authorization scoping

Discovery Timeline

2026-07-12 - CVE-2026-56252 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-56252

Vulnerability Analysis

Capgo issues API keys that can be scoped to individual applications through a limited_to_apps attribute. This attribute is intended to restrict a key's authority to a subset of resources belonging to a single application within an organization. The POST /webhooks/test endpoint does not consult this attribute when validating incoming requests. As a result, a caller authenticated with an app-scoped key can specify any webhook belonging to the parent organization and force the backend to deliver a signed test payload to the associated destination.

The vulnerability enables cross-scope actions within the same tenancy layer. Attackers can leverage the endpoint to enumerate organization webhook targets, deliver forged events to third-party listeners, and abuse the trust that receiving services place in Capgo's signed webhook payloads. Confidentiality and integrity impact remain limited because the abuse is confined to webhook test invocations rather than arbitrary data access.

Root Cause

The root cause is a missing authorization check in the request handler for POST /webhooks/test. The endpoint validates that the caller possesses a valid API key but does not compare the target webhook's owning application against the limited_to_apps list bound to that key. This is a classic [CWE-863] Incorrect Authorization pattern, where authentication succeeds while the subsequent access control decision is skipped.

Attack Vector

Exploitation requires network access to the Capgo API and a valid app-scoped API key issued for any application in a target organization. The attacker sends a POST request to /webhooks/test referencing a webhook identifier outside the key's declared app boundary. The backend accepts the request and dispatches a signed webhook delivery to the configured destination. No user interaction is required, and privileges required are limited to a low-privilege API key.

See the GitHub Security Advisory and VulnCheck Advisory for additional technical detail.

Detection Methods for CVE-2026-56252

Indicators of Compromise

Requests to POST /webhooks/test where the referenced webhook belongs to an application not present in the caller's limited_to_apps list.
Unexpected outbound signed webhook deliveries from Capgo to third-party endpoints without a corresponding user-initiated action in the Capgo dashboard.
API key usage patterns that traverse multiple applications within an organization from a single app-scoped credential.

Detection Strategies

Correlate API access logs with the limited_to_apps metadata of each key and flag any /webhooks/test call targeting a webhook outside the declared scope.
Monitor webhook delivery logs for test invocations that lack a matching authenticated session from an org-scoped user or admin key.
Alert on repeated POST /webhooks/test calls from the same API key against different app_id values within a short interval.

Monitoring Recommendations

Enable verbose audit logging on the /webhooks API surface and ship logs to a centralized SIEM for retention and analysis.
Track outbound webhook destinations and alert when signed deliveries occur to domains not previously observed for a given organization.
Review API key inventories regularly and identify keys with limited_to_apps constraints that have made cross-application requests.

How to Mitigate CVE-2026-56252

Immediate Actions Required

Upgrade Capgo to version 12.128.2 or later, which restores the limited_to_apps check on the POST /webhooks/test endpoint.
Rotate any app-scoped API keys that may have been used against unrelated webhooks pending patch deployment.
Audit organization webhook destinations and disable or reconfigure any that received unauthorized test deliveries.

Patch Information

The issue is resolved in Capgo 12.128.2. The fix enforces the limited_to_apps authorization check on POST /webhooks/test, ensuring the target webhook's owning application is present in the caller's declared app scope before dispatch. Refer to the GitHub Security Advisory GHSA-qvr7-f6j6-64wp for the upstream advisory and patch references.

Workarounds

Restrict issuance of app-scoped API keys until the patch is deployed and reduce the blast radius of any single key.
Place the Capgo API behind a reverse proxy or WAF rule that blocks POST /webhooks/test for callers using non-administrative credentials.
Temporarily disable outbound webhook integrations for high-value destinations until upgrade to 12.128.2 is complete.

bash

# Configuration example: block webhook test endpoint at the proxy layer
# Example nginx rule to restrict /webhooks/test to trusted internal callers
location = /webhooks/test {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://capgo_backend;
}