CVE-2026-56320

creationtimestamp| type| source ---|---|--- 2026-07-01 21:54:20+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmixwisds2o...

CVE-2026-56320 Capgo - Org/App Scope Mismatch in Device Creation Endpoint

Capgo before 12.128.2 contains an authorization flaw in POST /private/createdevice that accepts a caller-supplied orgid parameter without validating it matches the target app's owner organization. Authenticated attackers can create device records for an application using a foreign organization...