CVE-2026-56227CWE-918

Capgo - Server-Side Request Forgery via Webhook URL Validation

Medium · published June 20, 2026

CVSS v4.0
5.3
EPSS
0%
Percentile
16.8
In the wild
Unconfirmed
What it is

Capgo before 12.128.2 contains a server-side request forgery vulnerability in webhook URL validation that allows loopback and internal addresses. Organization admins can configure webhooks pointing to localhost or 127.0.0.1, and when triggered, the backend performs outbound requests to these addresses with error responses disclosed to users.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:L
EPSS
0.00260 · 16.8th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-06-20T15:24Z
EPSS history
Timeline
  • 20 JUN 15:24Z
    Capgo - Server-Side Request Forgery via Webhook URL Validation
    cvelistv5