CVE-2026-56295 Overview
CVE-2026-56295 is an authorization bypass vulnerability in Capgo versions prior to 12.128.2. The flaw resides in webhook management endpoints, where the checkWebhookPermission function fails to invoke apikeyHasOrgRightWithPolicy. This omission lets legacy non-expiring API keys bypass the require_apikey_expiration organization policy. Attackers holding such keys can list, create, and delete webhooks despite explicit organizational policy mandating key expiration. The issue is categorized under [CWE-285] Improper Authorization.
Critical Impact
Authenticated attackers with non-expiring API keys can manipulate webhook configurations, undermining organizational policy enforcement and enabling unauthorized integration changes.
Affected Products
- Capgo versions before 12.128.2
- Self-hosted Capgo deployments using webhook management endpoints
- Organizations enforcing the require_apikey_expiration policy
Discovery Timeline
- 2026-06-20 - CVE-2026-56295 published to NVD
- 2026-06-22 - Last updated in NVD database
Technical Details for CVE-2026-56295
Vulnerability Analysis
The vulnerability stems from inconsistent policy enforcement in Capgo's webhook permission layer. Capgo provides the require_apikey_expiration organization policy to ensure API keys carry expiration timestamps, reducing exposure from leaked or stale credentials. The checkWebhookPermission function authorizes webhook operations but does not call apikeyHasOrgRightWithPolicy, the helper responsible for validating policy-aware permissions. As a result, the policy is silently ignored for webhook routes.
Root Cause
The root cause is a missing authorization check [CWE-285]. While other endpoints route through apikeyHasOrgRightWithPolicy to evaluate both role and policy constraints, checkWebhookPermission only verifies basic key validity. Legacy non-expiring API keys, which would otherwise be rejected by the policy gate, retain full webhook privileges. The bypass is logical rather than cryptographic — no exploitation of memory, parsing, or protocol weaknesses is required.
Attack Vector
An attacker authenticated with a legacy non-expiring API key sends standard HTTP requests to webhook management endpoints. The attacker can enumerate existing webhooks, register new webhooks pointing to attacker-controlled URLs, or delete legitimate webhook integrations. Newly created webhooks may receive sensitive event payloads, and deletions can disrupt downstream automation. Exploitation requires only network access and low-privilege credentials with the require_apikey_expiration policy enabled at the organization level.
No public proof-of-concept code has been released. Refer to the GitHub Security Advisory and the VulnCheck Advisory for technical details.
Detection Methods for CVE-2026-56295
Indicators of Compromise
- Webhook creation, listing, or deletion events authenticated with API keys lacking an expires_at value.
- Unexpected webhook destinations pointing to unfamiliar external domains.
- Audit log entries referencing webhook endpoints invoked outside normal administrative workflows.
Detection Strategies
- Audit organizations with require_apikey_expiration enabled for any API keys that still lack expiration metadata.
- Correlate webhook management API calls with the issuing key's expiration status to flag policy violations.
- Review historical webhook configuration changes in versions prior to 12.128.2 for unauthorized modifications.
Monitoring Recommendations
- Enable verbose logging on all /webhooks endpoints, capturing the API key identifier and organization ID.
- Alert when webhook create or delete operations originate from non-expiring keys.
- Track outbound webhook destinations and baseline approved targets to detect unauthorized additions.
How to Mitigate CVE-2026-56295
Immediate Actions Required
- Upgrade Capgo to version 12.128.2 or later, which adds the missing apikeyHasOrgRightWithPolicy call inside checkWebhookPermission.
- Inventory all API keys per organization and revoke any legacy non-expiring keys.
- Re-issue API keys with explicit expiration timestamps aligned with the require_apikey_expiration policy.
- Review existing webhook configurations and remove any unrecognized destinations.
Patch Information
The maintainers fixed the bypass in Capgo 12.128.2 by routing webhook authorization through the policy-aware permission helper. See the GitHub Security Advisory GHSA-vwpp-cqv5-cmfm for the patched commit and upgrade guidance.
Workarounds
- Manually revoke all non-expiring API keys until the upgrade is applied.
- Restrict network access to webhook management endpoints via reverse proxy or WAF rules.
- Temporarily disable webhook management features for organizations that cannot rotate keys immediately.
- Monitor webhook endpoints and alert on any access by keys without an expiration claim.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
