CVE-2026-56079CWE-200

Capgo - Cross-Tenant Authorization Bypass via PostgREST Webhook Access

High · published June 19, 2026

CVSS v4.0
7.1
EPSS
0%
Percentile
34.1
In the wild
Unconfirmed
What it is

Capgo before 12.128.2 contains a cross-tenant authorization bypass vulnerability in PostgREST endpoints that allows org-scoped read API keys to access other tenants' webhook secrets and delivery logs. Attackers can query the webhooks and webhook_deliveries endpoints to exfiltrate HMAC signing secrets and delivery payloads, enabling forged webhook events against victim organizations.

The record
Technical detail
CVSS v4.0
7.1 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00409 · 34.1th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2026-06-19T21:39Z
EPSS history
Timeline
  • 19 JUN 21:39Z
    Capgo - Cross-Tenant Authorization Bypass via PostgREST Webhook Access
    cvelistv5