Medium
Capgo - Server-Side Validation Bypass via Direct Browser-Side Organization Security Settings Updates
Type: advisorySources: OSV
Capgo before 12.128.2 contains a server-side validation bypass vulnerability in organization security settings that allows authenticated org admins to persist invalid security policy state. Attackers can bypass backend validation by directly updating the public.orgs table from the browser, circumventing field-level validation checks for max_apikey_expiration_days and other security-sensitive configuration parameters.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-56333
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 7 Nov 2026, 06:44 UTC · Revision 1
Source evidence
Capgo - Server-Side Validation Bypass via Direct Browser-Side Organization Security Settings Updates
core-osv · Original sourcePublished 30 Jun 2026, 22:08 UTC
Capgo before 12.128.2 contains a server-side validation bypass vulnerability in organization security settings that allows authenticated org admins to persist invalid security policy state. Attackers can bypass backend validation by directly updating the public.orgs table from the browser, circumventing field-level validation checks for max_apikey_expiration_days and other security-sensitive configuration parameters.
osv:CVE-2026-56333
Complete source record
{
"id": "b839750883ac3390ef2cb04a9138c21230d9d9e93a98e9091c04d642bd5b1e65",
"url": "https://osv.dev/vulnerability/CVE-2026-56333",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Capgo - Server-Side Validation Bypass via Direct Browser-Side Organization Security Settings Updates",
"summary": "Capgo before 12.128.2 contains a server-side validation bypass vulnerability in organization security settings that allows authenticated org admins to persist invalid security policy state. Attackers can bypass backend validation by directly updating the public.orgs table from the browser, circumventing field-level validation checks for max_apikey_expiration_days and other security-sensitive configuration parameters.",
"evidence": "osv:CVE-2026-56333",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2026-56333",
"aliases": [
"CVE-2026-56333",
"GHSA-964v-j58v-2q3h"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/Cap-go/capgo.app",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "6685e5f11adef257bf3d085e481f4d8ebcec602e"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "12.128.2"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"range": [
{
"introduced": "0"
},
{
"fixed": "12.128.2"
}
],
"source": "DESCRIPTION"
}
]
}
}
],
"versions": [
"capgo-12.128.1",
"capgo-12.128.0",
"capgo-12.127.23",
"capgo-12.127.22",
"cli-7.95.10",
"capgo-12.127.21",
"capgo-12.127.20",
"capgo-12.127.19",
"capgo-12.127.18",
"capgo-12.127.17",
"cli-7.95.9",
"capgo-12.127.16",
"capgo-12.127.15",
"capgo-12.127.14",
"cli-7.95.8",
"capgo-12.127.13",
"capgo-12.127.12",
"cli-7.95.7",
"capgo-12.127.11",
"capgo-12.127.10",
"capgo-12.127.9",
"cli-7.95.6",
"capgo-12.127.8",
"capgo-12.127.5",
"cli-7.95.5",
"capgo-12.127.4",
"cli-7.95.4",
"capgo-12.127.3",
"capgo-12.127.2",
"cli-7.95.3",
"capgo-12.127.1",
"cli-7.95.2",
"capgo-12.127.0",
"cli-7.95.1",
"capgo-12.126.2",
"capgo-12.126.1",
"cli-7.95.0",
"capgo-12.126.0",
"capgo-12.125.0",
"cli-7.94.9",
"capgo-12.124.9",
"capgo-12.124.7",
"cli-7.94.8",
"cli-7.94.7",
"capgo-12.124.6",
"capgo-12.124.5",
"cli-7.94.6",
"capgo-12.124.4",
"cli-7.94.5",
"capgo-12.124.3",
"capgo-12.124.1",
"capgo-12.124.0",
"capgo-12.123.9",
"cli-7.94.1",
"cli-7.94.0",
"v12.123.8",
"v12.123.7",
"v12.123.6",
"v12.123.5",
"v12.123.4",
"v12.123.3",
"v12.123.2",
"v12.123.1",
"v12.123.0",
"v12.122.16",
"v12.122.15",
"v12.122.14",
"v12.122.13",
"v12.122.12",
"v12.122.11",
"v12.122.10",
"v12.122.9",
"v12.122.8",
"v12.122.7",
"v12.122.6",
"v12.122.5",
"v12.122.4",
"v12.122.3",
"v12.122.2",
"v12.122.1",
"v12.122.0",
"v12.121.11",
"v12.121.10",
"v12.121.9",
"v12.121.8",
"v12.121.7",
"v12.121.6",
"v12.121.5",
"v12.121.4",
"v12.121.2",
"v12.121.1",
"v12.121.0",
"v12.120.20",
"v12.120.19",
"v12.120.16",
"v12.120.15",
"v12.120.14",
"v12.120.13",
"v12.120.12",
"v12.120.11",
"v12.120.10",
"v12.120.9",
"v12.120.8",
"v12.120.7",
"v12.120.6",
"v12.120.5",
"v12.120.4",
"v12.119.21",
"v12.119.20",
"v12.119.19",
"v12.119.18",
"v12.119.17",
"v12.119.16",
"v12.119.15",
"v12.119.14",
"v12.119.13",
"v12.119.12",
"v12.119.10",
"v12.119.9",
"v12.119.8",
"v12.119.6",
"v12.119.5",
"v12.119.4",
"v12.119.3",
"v12.119.0",
"v12.118.2",
"v12.118.1",
"v12.118.0",
"v12.117.8",
"v12.117.6",
"v12.117.5",
"v12.117.4",
"v12.117.3",
"v12.117.2",
"v12.117.1",
"v12.116.72",
"v12.116.71",
"v12.116.70",
"v12.116.69",
"v12.116.68",
"v12.116.67",
"v12.116.66",
"v12.116.65",
"v12.116.64",
"v12.116.63",
"v12.116.62",
"v12.116.61",
"v12.116.60",
"v12.116.59",
"v12.116.58",
"v12.116.57",
"v12.116.56",
"v12.116.55",
"v12.116.54",
"v12.116.53",
"v12.116.52",
"v12.116.51",
"v12.116.50",
"v12.116.49",
"v12.116.48",
"v12.116.47",
"v12.116.46",
"v12.116.45",
"v12.116.41",
"v12.116.40",
"v12.116.39",
"v12.116.34",
"v12.116.33",
"v12.116.30",
"v12.116.29",
"v12.116.28",
"v12.116.27",
"v12.116.24",
"v12.116.23",
"v12.116.22",
"v12.116.21",
"v12.116.20",
"v12.116.19",
"v12.116.18",
"v12.116.17",
"v12.116.16",
"v12.116.15",
"v12.116.14",
"v12.116.13",
"v12.116.12",
"v12.116.11",
"v12.116.10",
"v12.116.9",
"v12.116.8",
"v12.116.7",
"v12.116.6",
"v12.116.5",
"v12.116.4",
"v12.116.3",
"v12.116.2",
"v12.116.1",
"v12.116.0",
"v12.115.2",
"v12.115.0",
"v12.114.12",
"v12.114.9",
"v12.114.7",
"v12.114.6",
"v12.114.4",
"v12.114.2",
"v12.114.1",
"v12.114.0",
"v12.113.2",
"v12.113.1",
"v12.113.0",
"v12.112.6",
"v12.112.5",
"v12.112.4",
"v12.112.3",
"v12.112.2",
"v12.112.1",
"v12.112.0",
"v12.111.3",
"v12.111.2",
"v12.111.1",
"v12.110.6",
"v12.110.5",
"v12.110.4",
"v12.110.3",
"v12.110.2",
"v12.110.0",
"v12.109.17",
"v12.109.15",
"v12.109.14",
"v12.109.13",
"v12.109.12",
"v12.109.11",
"v12.109.10",
"v12.109.9",
"v12.109.8",
"v12.109.7",
"v12.109.6",
"v12.109.5",
"v12.109.4",
"v12.109.3",
"v12.109.2",
"v12.109.1",
"v12.109.0",
"v12.108.19",
"v12.108.18",
"v12.108.17",
"v12.108.16",
"v12.108.15",
"v12.108.14",
"v12.108.13",
"v12.108.12",
"v12.108.11",
"v12.108.10",
"v12.108.9",
"v12.108.8",
"v12.108.7",
"v12.108.6",
"v12.108.5",
"v12.108.4",
"v12.108.3",
"v12.108.2",
"v12.108.1",
"v12.108.0",
"v12.107.26",
"v12.107.24",
"v12.107.22",
"v12.107.21",
"v12.107.20",
"v12.107.19",
"v12.107.11",
"v12.107.10",
"v12.107.8",
"v12.107.7",
"v12.107.6",
"v12.107.5",
"v12.107.4",
"v12.107.3",
"v12.107.2",
"v12.107.1",
"v12.107.0",
"v12.106.2",
"v12.106.1",
"v12.106.0",
"v12.105.9",
"v12.105.8",
"v12.105.6",
"v12.105.5",
"v12.105.4",
"v12.105.3",
"v12.105.0",
"v12.104.3",
"v12.104.2",
"v12.103.1",
"v12.102.6",
"v12.102.4",
"v12.102.3",
"v12.102.2",
"v12.102.1",
"v12.102.0",
"v12.101.1",
"v12.101.0",
"v12.100.15",
"v12.100.14",
"v12.100.13",
"v12.100.12",
"v12.100.11",
"v12.100.10",
"v12.100.9",
"v12.100.8",
"v12.100.7",
"v12.100.6",
"v12.100.5",
"v12.100.4",
"v12.100.3",
"v12.100.1",
"v12.100.0",
"v12.99.1",
"v12.99.0",
"v12.98.3",
"v12.98.2",
"v12.98.1",
"v12.97.1",
"v12.97.0",
"v12.96.2",
"v12.96.1",
"v12.96.0",
"v12.95.0",
"v12.94.6",
"v12.94.2",
"v12.94.1",
"v12.94.0",
"v12.93.6",
"v12.93.5",
"v12.93.4",
"v12.93.3",
"v12.93.2",
"v12.93.1",
"v12.93.0",
"v12.92.0",
"v12.91.15",
"v12.91.14",
"v12.91.12",
"v12.91.10",
"v12.91.9",
"v12.91.8",
"v12.91.7",
"v12.91.6",
"v12.91.5",
"v12.91.4",
"v12.91.3",
"v12.91.2",
"v12.91.1",
"v12.91.0",
"v12.90.3",
"v12.90.2",
"v12.90.1",
"v12.90.0",
"v12.89.17",
"v12.89.16",
"v12.89.15",
"v12.89.14",
"v12.89.12",
"v12.89.9",
"v12.89.6",
"v12.89.5",
"v12.87.1",
"v12.86.2",
"v12.86.0",
"v12.85.9",
"v12.85.8",
"v12.85.7",
"v12.85.4",
"v12.85.3",
"v12.85.2",
"v12.85.1",
"v12.85.0",
"v12.84.6",
"v12.84.5",
"v12.73.2",
"v12.56.26",
"v12.56.25",
"v12.56.24",
"v12.56.18",
"v12.56.16",
"v12.56.15",
"v12.56.14",
"v12.56.13",
"v12.56.12",
"v12.56.11",
"v12.56.10",
"v12.56.9",
"v12.56.8",
"v12.56.7",
"v12.56.6",
"v12.56.4",
"v12.56.2",
"v12.56.1",
"v12.56.0",
"v12.55.9",
"v12.55.8",
"v12.55.5",
"v12.55.4",
"v12.55.3",
"10.0.0",
"1.66.4",
"1.64.1",
"1.62.4",
"1.62.1",
"1.62.0",
"1.61.35",
"1.61.34",
"1.61.33",
"1.61.27",
"1.61.23",
"1.61.21",
"1.61.17",
"1.61.15",
"1.61.14",
"1.61.12",
"1.61.2",
"1.60.4",
"1.58.16",
"1.58.15",
"1.58.1",
"1.55.44",
"1.55.43",
"1.55.42",
"1.55.39",
"1.55.38",
"1.55.37",
"1.55.35",
"1.55.31",
"1.55.23",
"1.55.12",
"1.55.9",
"1.55.6",
"1.55.5",
"1.55.4",
"1.55.3",
"1.55.2",
"1.55.0",
"1.54.9",
"1.54.6",
"1.54.5",
"1.54.4",
"1.54.3",
"1.54.2",
"1.54.1",
"1.54.0",
"1.53.8",
"1.53.7",
"1.53.6",
"1.53.5",
"1.53.4",
"1.53.3",
"1.53.2",
"1.53.1",
"1.53.0",
"1.52.3",
"1.52.2",
"1.52.1",
"1.51.0",
"1.50.3",
"1.50.2",
"1.50.1",
"1.50.0",
"1.48.1",
"1.48.0",
"1.47.3",
"1.47.1",
"1.47.0",
"1.46.4",
"1.46.0",
"1.45.4",
"1.45.3",
"1.45.2",
"1.45.1",
"1.45.0",
"1.44.26",
"1.44.21",
"1.44.19",
"1.44.16",
"1.44.15",
"1.44.12",
"1.44.11",
"1.44.1",
"1.43.1",
"1.39.0",
"1.37.31",
"1.37.22",
"1.37.15",
"1.37.5",
"1.36.49",
"1.36.41",
"1.36.25",
"1.36.24",
"1.36.22",
"1.36.15",
"1.36.12",
"1.36.8",
"1.36.7",
"1.36.4",
"1.35.1",
"1.35.0",
"1.34.0",
"1.33.3",
"1.31.4",
"1.31.3",
"1.31.1",
"1.28.3",
"1.27.6",
"1.27.3",
"1.27.2",
"1.27.1",
"1.27.0",
"1.26.2",
"1.26.1",
"1.25.14",
"1.25.7",
"1.25.6",
"1.25.2",
"1.24.18",
"1.24.17",
"1.24.16",
"1.24.10",
"1.24.3",
"1.24.2",
"1.24.1",
"1.24.0",
"1.23.1",
"1.23.0",
"1.22.2",
"1.22.1",
"1.21.25",
"1.21.23",
"1.21.19",
"1.21.11",
"1.21.10",
"1.21.9",
"1.21.8",
"1.21.7",
"1.21.6",
"1.21.0",
"1.20.3",
"1.20.2",
"1.20.1",
"1.20.0",
"1.19.5",
"1.19.4",
"1.19.3",
"1.18.36",
"1.18.33",
"1.18.28",
"1.18.26",
"1.18.24",
"1.18.16",
"1.18.10",
"1.18.9",
"1.18.8",
"1.18.5",
"1.18.4",
"1.18.2",
"1.18.1",
"1.18.0",
"1.17.0",
"1.17.0-alpha.1",
"1.17.0-alpha.0",
"1.16.3-alpha.0",
"1.16.1-alpha.0",
"1.16.0-alpha.0",
"1.14.6",
"1.14.4",
"1.13.13",
"1.13.12",
"1.13.11",
"1.13.5",
"1.13.4",
"1.13.3",
"1.12.1",
"1.11.1",
"1.11.0",
"1.10.2",
"1.10.1",
"1.10.0",
"1.9.10",
"1.9.9",
"1.9.7",
"1.9.6",
"1.9.1",
"1.9.0-alpha.0",
"1.8.7-alpha.2",
"1.8.7-alpha.1",
"1.8.7-alpha.0",
"1.8.6",
"1.8.3",
"1.8.1",
"1.7.28",
"1.7.27",
"1.7.24",
"1.7.15",
"1.7.10",
"1.6.11",
"1.6.7",
"0.30.19",
"0.30.12",
"0.30.12-alpha.1",
"0.30.9-alpha.16",
"0.30.9-alpha.15",
"0.30.9-alpha.10",
"0.30.9-alpha.9",
"0.30.9-alpha.6",
"0.30.9-alpha.3",
"0.30.9-alpha.0",
"0.30.8-alpha.4",
"0.30.8-alpha.1",
"0.30.8-alpha.0",
"0.30.6-alpha.2",
"0.30.6-alpha.0",
"0.30.5-alpha.4",
"0.30.2",
"0.29.5",
"0.29.1",
"0.26.1",
"0.26.0",
"0.24.1",
"0.23.0",
"0.20.2",
"0.20.1",
"0.19.0",
"0.18.2",
"0.16.3",
"0.16.1",
"0.16.0",
"0.15.1",
"0.14.6",
"0.14.5",
"0.14.2",
"0.14.0",
"0.11.0",
"0.6.1",
"0.3.1",
"0.1.8",
"0.1.6"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-56333.json"
}
}
],
"modified": "2026-10-28T02:30:49.968960879Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56333.json",
"https://github.com/Cap-go/capgo/security/advisories/GHSA-964v-j58v-2q3h",
"https://nvd.nist.gov/vuln/detail/CVE-2026-56333",
"https://www.vulncheck.com/advisories/capgo-server-side-validation-bypass-via-direct-browser-side-organization-security-settings-updates"
],
"provider_metadata": {
"cwe_ids": [
"CWE-20"
],
"cna_assigner": "VulnCheck",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56333.json"
}
},
"related_cves": [
{
"value": "CVE-2026-56333",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 518537,
"published_at": "2026-06-30T22:08:33.385+00:00"
}