CVE-2026-56257: Capgo

High severity, CVSS 7.1. EPSS: 0.3% chance of exploitation in the next 30 days.

Capgo before 12.128.2 allows direct patching of public.apps.owner_org through PostgREST, bypassing the transfer_app() workflow and creating split-brain ownership. Attackers can directly update apps.owner_org while leaving app_versions.owner_org unchanged, enabling old-org keys to retain access to version data while new-org keys control the app record.

Affected products

• Capgo Capgo: before 12.128.2 (fixed in 12.128.2)

Published 2026-06-24. Last modified 2026-06-25.