CVE-2026-56247
HIGH
NVD
CVSS Score
8.8
Severity
HIGH
Published
Jun 30, 2026
Vendor
unknown
Description
Capgo before 12.128.2 allows org admins to assign org-scoped RBAC roles at app scope without validating role scope compatibility, including to pending invitees. Attackers can pre-seed malformed high-privilege bindings that survive invite acceptance, enabling accepted low-privilege users to perform unauthorized privileged app actions.