CVE-2026-56249 Details

An authorization bypass vulnerability has been identified in Capgo versions prior to 12.128.2. This vulnerability allows authenticated users with the app.create_channel permission to overwrite existing channels by reusing their names. The issue arises from a logic mismatch between existence validation and upsert operations in the channel creation endpoint. Exploitation of this vulnerability enables attackers to reassign channel ownership and modify critical configurations of production channels.

Users are advised to update to Capgo version 12.128.2 or later. To address the vulnerability, ensure that existence checks in the channel creation logic align with the upsert operations, enforce proper authorization before allowing updates to existing channels, and consider making the created_by field immutable or removing it from update payloads.