CVE-2026-56333

Capgo before 12.128.2 contains a server-side validation bypass vulnerability in organization security settings that allows authenticated org admins to persist invalid security policy state. Attackers can bypass backend validation by directly updating the public.orgs table from the browser,...

CVE-2026-56247 Capgo - Privilege Escalation via Cross-Scope RBAC Role Assignment

Capgo before 12.128.2 allows org admins to assign org-scoped RBAC roles at app scope without validating role scope compatibility, including to pending invitees. Attackers can pre-seed malformed high-privilege bindings that survive invite acceptance, enabling accepted low-privilege users to perfor...

CVE-2024-46918

CVE-2024-46918 affects MISP prior to 2.4.198. The issue is in app/Controller/UserLoginProfilesController.php where an org admin can view sensitive login fields of another org admin within the same org. Root cause: inadequate access controls on login profile data. Impact: high confidentiality and ...