CVE-2026-56295CWE-285

Capgo - Policy Enforcement Bypass in Webhook Management Endpoints via Non-Expiring API Keys

Medium · published June 20, 2026

CVSS v4.0
5.3
EPSS
0%
Percentile
22.9
In the wild
Unconfirmed
What it is

Capgo before 12.128.2 contains an authorization bypass vulnerability in webhook management endpoints that allows non-expiring API keys to bypass the require_apikey_expiration organization policy. The checkWebhookPermission function fails to call apikeyHasOrgRightWithPolicy, enabling attackers with legacy non-expiring keys to list, create, and delete webhooks despite explicit organizational policy requiring key expiration.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
EPSS
0.00312 · 22.9th percentile
Weakness
CWE-285 · Improper Authorization
Published
2026-06-20T15:24Z
EPSS history
Timeline
  • 20 JUN 15:24Z
    Capgo - Policy Enforcement Bypass in Webhook Management Endpoints via Non-Expiring API Keys
    cvelistv5