CVE-2026-56249 — Capgo - Unauthorized Channel Overwrite and Ownership Takeover via POST /channel Name Collision
Capgo before 12.128.2 contains an authorization bypass vulnerability in the channel creation endpoint that allows authenticated users to overwrite existing channels by reusing t…
Published: 2026-06-30 · CVSS: 7.2 · CVSS 4.0
Capgo before 12.128.2 contains an authorization bypass vulnerability in the channel creation endpoint that allows authenticated users to overwrite existing channels by reusing their names. Attackers with app.create_channel permission can exploit a logic mismatch between existence validation and upsert operations to reassign channel ownership and modify critical production channel configurations.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7