Security Advisory

CVE-2026-56295

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-06-20 15:24:46

Last updated 2026-06-22 18:12:58

Assigner VulnCheck

CVSS score 5.3

State PUBLISHED

Description

Capgo before 12.128.2 contains an authorization bypass vulnerability in webhook management endpoints that allows non-expiring API keys to bypass the require_apikey_expiration organization policy. The checkWebhookPermission function fails to call apikeyHasOrgRightWithPolicy, enabling attackers with legacy non-expiring keys to list, create, and delete webhooks despite explicit organizational policy requiring key expiration.

← Browse all CVEs View on cve.org ↗