CVE-2026-56257: Capgo Authentication Bypass Vulnerability

CVE-2026-56257 Overview

CVE-2026-56257 is an authorization bypass vulnerability in Capgo before version 12.128.2. The flaw allows authenticated attackers to directly patch the public.apps.owner_org column through PostgREST, circumventing the intended transfer_app() workflow. Because the patch only updates the apps table without propagating the change to app_versions.owner_org, the application enters a split-brain ownership state. Old-organization keys retain access to version data while new-organization keys control the application record. The vulnerability is tracked under CWE-284: Improper Access Control.

Critical Impact
Authenticated users can hijack application ownership records while leaving version data accessible to the prior owner, breaking the integrity of multi-tenant isolation in Capgo.

Affected Products

Capgo versions prior to 12.128.2
Capgo self-hosted deployments exposing PostgREST endpoints
Capgo Cap-go/capgo project repository on GitHub

Discovery Timeline

2026-06-24 - CVE-2026-56257 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-56257

Vulnerability Analysis

The vulnerability resides in how Capgo exposes the public.apps table through PostgREST. Capgo provides a transfer_app() server-side function that performs the complete ownership transition. This routine updates the owner_org column on both apps and the associated app_versions rows in a single transactional workflow.

PostgREST, however, also exposes direct write access to the apps row. Authenticated callers with low privileges can issue a PATCH against apps and modify owner_org directly. The Row-Level Security policies do not require the caller to use transfer_app(), and no trigger keeps app_versions.owner_org in sync.

The outcome is split-brain ownership. The apps record reports the new organization, but the app_versions records still belong to the original organization. API keys scoped to the old organization continue to read and modify version artifacts, while keys scoped to the new organization control the application identity.

Root Cause

The root cause is improper access control on a sensitive column [CWE-284]. The data model assumes ownership changes flow through transfer_app(), but the database authorization layer does not enforce that assumption. PostgREST honors any direct update permitted by the role's grants and RLS policies.

Attack Vector

Exploitation requires a network-reachable PostgREST endpoint and a valid low-privilege Capgo account. The attacker sends a crafted PATCH /apps?id=eq.<app_id> request that sets owner_org to a controlled organization identifier. No user interaction is required. Refer to the GitHub Security Advisory GHSA-v9jp-r5wh-qqcp and the VulnCheck advisory for the documented exploitation path.

Detection Methods for CVE-2026-56257

Indicators of Compromise

PostgREST access logs containing PATCH /apps requests that include owner_org in the JSON body outside of the transfer_app() RPC path.
Database rows where apps.owner_org differs from the owner_org of related app_versions for the same app_id.
Unexpected organization identifier changes on apps records without a matching audit entry from the transfer workflow.

Detection Strategies

Query the database for split-brain state with a join such as SELECT a.id FROM apps a JOIN app_versions v ON v.app_id = a.id WHERE a.owner_org <> v.owner_org.
Alert on PostgREST PATCH operations targeting the apps resource where the request payload references owner_org.
Review API keys that have written to apps rows belonging to organizations other than their issuing tenant.

Monitoring Recommendations

Enable PostgreSQL pgaudit logging for UPDATE statements on public.apps and forward logs to a centralized SIEM for correlation.
Monitor anomalous ownership transitions and rate-limit direct table writes from non-administrative roles.
Track usage of the legitimate transfer_app() RPC and treat ownership changes that bypass it as suspicious.

How to Mitigate CVE-2026-56257

Immediate Actions Required

Upgrade Capgo to version 12.128.2 or later across all instances exposing PostgREST.
Audit apps and app_versions for ownership mismatches and reconcile any split-brain records before rotating affected API keys.
Revoke and reissue API keys for organizations whose applications were transferred during the exposure window.

Patch Information

The maintainers fixed the issue in Capgo 12.128.2. The patch removes direct write access to owner_org and forces ownership changes through the transfer_app() workflow, ensuring apps and app_versions are updated atomically. See the GitHub Security Advisory for commit references.

Workarounds

Restrict the PostgREST role grants so that low-privilege users cannot UPDATE the owner_org column on public.apps.
Add a column-level RLS policy or BEFORE UPDATE trigger that rejects direct modifications of owner_org outside the transfer_app() function.
Place a reverse proxy in front of PostgREST that blocks PATCH requests to /apps containing owner_org in the JSON body until the upgrade is applied.

bash

# Example PostgreSQL hardening: revoke direct update on the sensitive column
REVOKE UPDATE (owner_org) ON public.apps FROM authenticated;
REVOKE UPDATE (owner_org) ON public.app_versions FROM authenticated;

# Grant ownership transition only via the controlled function
GRANT EXECUTE ON FUNCTION public.transfer_app(uuid, uuid) TO authenticated;