CVE-2026-56249
HIGH
NVD
CVSS Score
7.6
Severity
HIGH
Published
Jun 30, 2026
Vendor
unknown
Description
Capgo before 12.128.2 contains an authorization bypass vulnerability in the channel creation endpoint that allows authenticated users to overwrite existing channels by reusing their names. Attackers with app.create_channel permission can exploit a logic mismatch between existence validation and upsert operations to reassign channel ownership and modify critical production channel configurations.