CVE-2026-56333 Overview
CVE-2026-56333 is a server-side validation bypass vulnerability in Capgo versions before 12.128.2. The flaw resides in the organization security settings workflow, where backend validation checks can be circumvented by directly updating the public.orgs table from the browser. Authenticated organization administrators can persist invalid security policy state, including malformed values for max_apikey_expiration_days and other security-sensitive configuration parameters. The issue is categorized under CWE-20 (Improper Input Validation).
Critical Impact
Authenticated org admins can persist invalid organization security policies by bypassing field-level validation, weakening controls such as API key expiration limits.
Affected Products
- Capgo versions prior to 12.128.2
- Capgo self-hosted deployments exposing the public.orgs table to browser clients
- Capgo multi-tenant organizations relying on server-side policy validation
Discovery Timeline
- 2026-06-30 - CVE-2026-56333 published to the National Vulnerability Database (NVD)
- 2026-07-01 - Last updated in NVD database
Technical Details for CVE-2026-56333
Vulnerability Analysis
Capgo exposes organization security settings through a workflow that validates fields such as max_apikey_expiration_days before persisting changes. The validation logic runs in the application layer rather than being enforced at the database layer through constraints or row-level security policies. An authenticated organization administrator can bypass the intended validation path by issuing direct update requests against the public.orgs table from the browser client. This permits values that the intended workflow would reject to be written to the database. The persisted invalid state then governs subsequent security policy decisions for the organization.
Root Cause
The root cause is missing server-side enforcement of field-level constraints on the public.orgs table. Validation is implemented only in the higher-level update flow, not through database constraints, triggers, or authorization rules that gate direct table writes. As a result, any client permitted to write to the table can supply values outside the intended range without triggering rejection.
Attack Vector
An attacker requires an authenticated session as an organization administrator. The attacker issues a direct update to public.orgs from the browser, setting security-sensitive fields such as max_apikey_expiration_days to values the application UI would refuse. The database accepts and persists the write. The organization then operates under a policy state that was never validated, weakening intended safeguards on API key lifetime and related settings. Refer to the GitHub Security Advisory GHSA-964v-j58v-2q3h and the VulnCheck Advisory for additional detail.
Detection Methods for CVE-2026-56333
Indicators of Compromise
- Rows in public.orgs containing values for max_apikey_expiration_days outside the documented allowed range.
- API keys within an organization whose expiration dates exceed the policy limits enforced by the application UI.
- Client-originated database update requests targeting public.orgs outside the standard settings workflow.
Detection Strategies
- Query the public.orgs table for out-of-range values in security policy columns and flag any records that deviate from expected bounds.
- Correlate database audit logs with application-layer settings events to identify updates that did not traverse the validation workflow.
- Alert on API key issuance events where the requested lifetime exceeds intended organizational maximums.
Monitoring Recommendations
- Enable database-level audit logging for all writes to public.orgs and forward events to a centralized log store.
- Baseline typical organization settings and monitor for administrator-initiated updates that skip the standard configuration UI paths.
- Track changes to max_apikey_expiration_days and comparable policy fields across tenants to detect anomalous relaxations.
How to Mitigate CVE-2026-56333
Immediate Actions Required
- Upgrade Capgo to version 12.128.2 or later, which restores enforcement of field-level validation.
- Audit existing public.orgs rows for out-of-range values and reset them to policy-compliant defaults.
- Rotate any API keys whose expiration exceeds the intended maximum defined by the organization's security policy.
Patch Information
The fix is available in Capgo 12.128.2. Operators should review the GitHub Security Advisory GHSA-964v-j58v-2q3h for upgrade guidance and the specific validation controls restored by the patched release.
Workarounds
- Restrict browser-side write access to the public.orgs table through row-level security or equivalent authorization policies until the upgrade is applied.
- Add database-level CHECK constraints on max_apikey_expiration_days and related security fields to reject out-of-range values regardless of client path.
- Limit organization administrator accounts to trusted personnel and require multi-factor authentication for administrative sessions.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
