CVE-2026-56227

5.3 mediumEPSS 0.3%

Medium (5.3). EPSS 0.3% chance of exploitation in the next 30 days.

Capgo before 12.128.2 contains a server-side request forgery vulnerability in webhook URL validation that allows loopback and internal addresses. Organization admins can configure webhooks pointing to localhost or 127.0.0.1, and when triggered, the backend performs outbound requests to these addresses with error responses disclosed to users.

Severity

CVSS 4.0

5.3 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:L

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 17% of CVEs (scores of 2026-10-31)
CWE: CWE-918
Published: 2026-06-20
Modified: 2026-06-22
Record from: the NVD, synced 2026-10-19

References

https://github.com/Cap-go/capgo/security/advisories/GHSA-48hc-53hv-6x3f
https://www.vulncheck.com/advisories/capgo-server-side-request-forgery-via-webhook-url-validation
https://github.com/Cap-go/capgo/security/advisories/GHSA-48hc-53hv-6x3f

Check your stack JSON