CVE-2026-56320: Capgo Authorization Bypass Vulnerability

CVE-2026-56320 Overview

CVE-2026-56320 is an authorization flaw in Capgo versions prior to 12.128.2. The vulnerability resides in the POST /private/create_device endpoint, which accepts a caller-supplied org_id parameter without validating that it matches the target application's owner organization. Authenticated attackers can create device records for an application while referencing a foreign organization identifier. This breaks the intended org-to-app authorization boundary and enables cross-tenant data pollution. The weakness is categorized as [CWE-285] Improper Authorization.

Critical Impact
Authenticated attackers can insert device records tied to applications belonging to organizations they do not own, corrupting tenant scope and integrity of device inventories.

Affected Products

Capgo self-hosted and managed deployments prior to version 12.128.2
The /private/create_device API endpoint
Multi-tenant Capgo instances hosting applications across multiple organizations

Discovery Timeline

2026-06-30 - CVE-2026-56320 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-56320

Vulnerability Analysis

Capgo exposes a private API route at POST /private/create_device used to register device records tied to an application. The handler trusts the org_id value supplied in the request body. It does not cross-check that the org_id corresponds to the organization that actually owns the referenced application. Because the check is missing, a caller authenticated to any organization can submit an arbitrary org_id and have the server persist the device record under that scope.

The flaw allows cross-tenant writes without requiring privilege escalation on the target tenant. An attacker only needs a valid authenticated session with low privileges. The integrity impact is significant because tampered device inventories drive update targeting, telemetry, and license accounting in Capgo. Confidentiality impact is limited because the endpoint writes rather than reads sensitive data.

Root Cause

The root cause is missing server-side authorization on a tenant-scoping parameter. The endpoint treats org_id as trusted user input rather than deriving it from the authenticated session or from the target application's owner record. This mirrors the [CWE-285] pattern in which authorization checks are absent or incomplete on sensitive state-changing operations.

Attack Vector

Exploitation occurs over the network by an authenticated user. The attacker sends a crafted POST /private/create_device request containing an app_id for an application they do not own and an org_id referencing an organization they do not belong to. The server accepts the request and writes the device record. No user interaction is required on the victim side. See the GitHub Security Advisory and the VulnCheck Advisory on Capgo for the disclosed technical details.

Detection Methods for CVE-2026-56320

Indicators of Compromise

Requests to POST /private/create_device where the request body org_id does not match the authenticated user's organization membership.
Device records whose org_id differs from the owning application's org_id in the Capgo database.
Bursts of device creations sourced from a single authenticated principal referencing multiple distinct org_id values.

Detection Strategies

Add server-side logging that records the authenticated principal, the submitted org_id, and the resolved application owner org_id for every call to /private/create_device.
Query the devices table for rows where devices.org_id is inconsistent with the apps.org_id of the linked application.
Compare pre-upgrade and post-upgrade device inventories to identify records inserted through the vulnerable path.

Monitoring Recommendations

Alert on any HTTP 2xx response from /private/create_device when the request org_id differs from the session's organization scope.
Rate-limit and alert on repeated device creation from a single JWT or API key across multiple organizations within a short window.
Forward Capgo API logs to a centralized analytics platform to retain evidence for post-incident review.

How to Mitigate CVE-2026-56320

Immediate Actions Required

Upgrade Capgo to version 12.128.2 or later on all self-hosted and managed instances.
Audit the devices table for records whose org_id does not match the owning application's org_id and remove or reassign them after validation.
Rotate API keys and session tokens for principals observed calling /private/create_device with mismatched org_id values.

Patch Information

The fix is included in Capgo 12.128.2. The patched handler validates that the supplied org_id matches the application owner organization before persisting the device record. Refer to the GitHub Security Advisory for commit-level detail and upgrade guidance.

Workarounds

Restrict network access to /private/create_device at the reverse proxy or API gateway until the upgrade is applied.
Enforce an ingress rule that rejects requests to the endpoint whose JWT organization claim differs from the body org_id value.
Temporarily disable programmatic device registration and require operator-mediated provisioning until patching is complete.

bash

# Configuration example: block mismatched org_id at an nginx reverse proxy
location = /private/create_device {
    # Require an internal header set by the auth layer after validating
    # that the JWT org claim matches the request body org_id.
    if ($http_x_org_scope_verified != "1") {
        return 403;
    }
    proxy_pass http://capgo_upstream;
}