CVE-2026-56293

5.3 mediumEPSS 0.2%

Medium (5.3). EPSS 0.2% chance of exploitation in the next 30 days.

Capgo before 12.128.2 contains an authorization flaw in transfer_app() that fails to update deploy_history.owner_org when transferring applications between organizations. Attackers can exploit this omission to retain unauthorized access to deployment history records in the source organization or cause the destination organization to lose access to transferred application deployment records.

Severity

CVSS 4.0

5.3 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 15% of CVEs (scores of 2026-10-31)
CWE: CWE-285
Published: 2026-07-08
Modified: 2026-07-08
Record from: the NVD, synced 2026-10-19

References

https://github.com/Cap-go/capgo/security/advisories/GHSA-854w-xj7g-prv3
https://www.vulncheck.com/advisories/capgo-stale-cross-organization-authorization-via-incomplete-deploy-history-update-in-transfer-app
https://github.com/Cap-go/capgo/security/advisories/GHSA-854w-xj7g-prv3

Check your stack JSON