Dashboard / CVE-2026-56227

CVE-2026-56227

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 61/100
Published: 2026-06-20 Modified: 2026-11-08 First seen: 2026-11-08 Status: active

Attack Surface

Network Low Complexity No Interaction

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
AT: None
VC: Low
VI: Low
VA: None

Description

Capgo before 12.128.2 contains a server-side request forgery vulnerability in webhook URL validation that allows loopback and internal addresses. Organization admins can configure webhooks pointing to localhost or 127.0.0.1, and when triggered, the backend performs outbound requests to these addresses with error responses disclosed to users.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
Capgo Capgo 0 < 12.128.2

References & Advisories (2)

Bug Bounty Relevance

61 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

5.3 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:L

EPSS — Exploitation Probability

0.26%
Raw Score 0.002600
Percentile 17.9%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00260
2026-11-12
0.00260
2026-11-10
0.00260
2026-11-09
0.00260
2026-11-08
0.00260

Intelligence Sources

mitre ref →

External Links