CVE-2026-56329CWE-436

Capgo - Cross-Tenant Preview Namespace Collision via Non-Bijective Underscore Decoding

Medium · published July 10, 2026

CVSS v4.0
5.3
EPSS
0%
Percentile
24.4
In the wild
Unconfirmed
What it is

Capgo before 12.128.2 contains a cross-tenant preview namespace collision vulnerability caused by non-bijective decoding of double underscores to dots in preview hostname parsing. Attackers can register app IDs with underscores that collide with other tenants' dotted app IDs, causing preview misrouting and denial of preview access for victim applications.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L
EPSS
0.00325 · 24.4th percentile
Weakness
CWE-436 · Interpretation Conflict
Published
2026-07-10T13:57Z
EPSS history
Timeline
  • 10 JUL 13:57Z
    Capgo - Cross-Tenant Preview Namespace Collision via Non-Bijective Underscore Decoding
    cvelistv5