Cloudanix VulnDB

CVE-2026-56335

Medium · 6.5

CVSS

6.5

EPSS

—

Published

Jul 10, 2026

CISA due date

—

The record

Capgo before 12.128.2 contains an authorization bypass vulnerability where write-scoped API keys can directly mutate protected channel configuration fields through PostgREST by exploiting a null authentication check in the immutability trigger. Attackers with write API keys can modify sensitive channel attributes such as public, allow_emulator, and security-related flags outside intended application routes.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities