CVE-2026-56240: Capgo

Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days.

Capgo before 12.128.12 contains a billing authorization bypass vulnerability in the plan_valid calculation that allows organizations with exhausted or expired usage credit grants to bypass billing gates. Attackers can exploit the divergence between the plugin hot-path plan_valid expression and the authoritative billing gate to gain continued access to /updates, /stats, /channel_self, and attachment upload endpoints after credit depletion.

Affected products

• Capgo Capgo: before 12.128.12 (fixed in 12.128.12)

Published 2026-07-11. Last modified 2026-07-13.