CVE-2026-56283: Capgo XSS Vulnerability in Organization

CVE-2026-56283 Overview

CVE-2026-56283 is an HTML injection vulnerability in Capgo versions before 12.128.2. The flaw resides in the organization settings endpoint, where the organization name field fails to sanitize user-supplied HTML content. Attackers with a low-privileged authenticated account can inject malicious markup that renders in other users' browsers. The injected content can redirect victims to attacker-controlled sites, facilitating phishing campaigns and brand impersonation. The issue is tracked as CWE-79 and requires user interaction to trigger.

Critical Impact
Authenticated attackers can inject HTML into the organization name field to redirect Capgo users to untrusted domains, enabling phishing and reputational damage.

Affected Products

Capgo versions prior to 12.128.2
Capgo organization settings endpoint
Deployments exposing multi-tenant organization management

Discovery Timeline

2026-07-08 - CVE-2026-56283 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-56283

Vulnerability Analysis

The vulnerability is a stored HTML injection issue in the Capgo organization settings endpoint. The application accepts organization name values from authenticated users and later renders that content in web views without adequate output encoding. Because the input is treated as markup rather than plain text, attackers can embed anchor tags, iframes, or other HTML constructs. When other members of the platform view the affected organization, their browsers render the injected content in the context of the Capgo application. The primary demonstrated impact is open redirection through crafted hyperlinks, which supports phishing workflows against Capgo users.

Root Cause

The root cause is missing output encoding for the organization name field. The server accepts arbitrary HTML content and stores it verbatim. Rendering paths that display the organization name do not apply HTML entity encoding, allowing browser-interpretable markup to reach the DOM. This maps to CWE-79, improper neutralization of input during web page generation.

Attack Vector

An attacker first authenticates to Capgo with low privileges sufficient to modify organization settings. The attacker sets the organization name to a payload containing HTML markup, such as an anchor tag pointing to an external phishing domain. When a legitimate user navigates to a page that renders the organization name, the injected link is rendered as clickable HTML. User interaction is required to complete the redirection, which aligns with the reported attack scenario. Refer to the VulnCheck Advisory on HTML Injection and the GitHub Security Advisory for technical detail.

Detection Methods for CVE-2026-56283

Indicators of Compromise

Organization name fields containing HTML tags such as <a>, <iframe>, <img>, or <script>.
Outbound HTTP requests from user sessions to domains that do not match Capgo-owned assets.
Audit log entries showing organization name updates immediately followed by user redirects.

Detection Strategies

Inspect the Capgo database for organization records whose name field contains angle brackets or URL patterns.
Review web server access logs for PATCH or POST requests to the organization settings endpoint with payloads containing HTML entities.
Correlate referer headers from user browsers to identify redirects originating from Capgo pages to third-party domains.

Monitoring Recommendations

Alert on organization profile changes that introduce HTML metacharacters into name fields.
Track authenticated write operations by low-privilege accounts against organization settings.
Monitor Content Security Policy (CSP) violation reports for inline content originating from tenant-controlled fields.

How to Mitigate CVE-2026-56283

Immediate Actions Required

Upgrade Capgo to version 12.128.2 or later on all self-hosted deployments.
Audit existing organization name values and normalize any records containing HTML markup.
Reset or review sessions of users who may have interacted with tampered organization pages.

Patch Information

The fix is included in Capgo 12.128.2. Details are published in the GitHub Security Advisory GHSA-vhvc-gxfh-m85g. The upgrade introduces proper output encoding for the organization name field so that HTML metacharacters are rendered as text rather than parsed as markup.

Workarounds

Restrict permissions to modify organization settings to trusted administrators until the patch is applied.
Apply a server-side input validation rule that rejects organization names containing <, >, or URL schemes.
Enforce a strict Content Security Policy that blocks inline navigation to untrusted external domains.

bash

# Configuration example: upgrade Capgo to the patched release
npm install @capgo/capgo@^12.128.2
# or, for containerized deployments
docker pull capgo/capgo:12.128.2