CVE-2026-56283CWE-79

Capgo - HTML Injection Leading to Open Redirection in Organization Settings

Medium · published July 8, 2026

CVSS v4.0
4.8
EPSS
0%
Percentile
13.6
In the wild
Unconfirmed
What it is

Capgo before 12.128.2 contains an html injection vulnerability in the organization settings endpoint that allows attackers to inject malicious HTML content. Attackers can craft payloads in the organization name field to redirect users to untrusted websites, enabling phishing attacks and reputational damage.

The record
Technical detail
CVSS v4.0
4.8 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
EPSS
0.00235 · 13.6th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-07-08T13:48Z
EPSS history
Timeline
  • 08 JUL 13:48Z
    Capgo - HTML Injection Leading to Open Redirection in Organization Settings
    cvelistv5