{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/capgo/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.3,"id":"CVE-2026-56241"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Capgo"],"_cs_severities":["high"],"_cs_tags":["privilege-escalation","vulnerability","capgo","cloud"],"_cs_type":"advisory","_cs_vendors":["Capgo"],"content_html":"\u003cp\u003eA critical privilege escalation vulnerability, tracked as CVE-2026-56241, has been identified in Capgo versions released before 12.128.2. This flaw allows a previously appointed super_admin user, even after being demoted from that role, to retain unauthorized access to specific Remote Procedure Calls (RPCs): \u003ccode\u003edelete_non_compliant_bundles\u003c/code\u003e and \u003ccode\u003ecount_non_compliant_bundles\u003c/code\u003e. The root cause is an issue where the \u003ccode\u003eorg_users.user_right\u003c/code\u003e column is not properly cleared when role bindings are removed. An attacker can exploit this oversight to continue performing high-privilege actions, such as enumerating and bulk deleting non-compliant bundles across an entire organization, effectively maintaining super_admin capabilities indefinitely despite their demoted status. This vulnerability poses a significant risk to data integrity and service availability for organizations utilizing Capgo.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn adversary, previously a \u003ccode\u003esuper_admin\u003c/code\u003e user within a Capgo organization, is officially demoted from their administrative role.\u003c/li\u003e\n\u003cli\u003eDue to the vulnerability (CVE-2026-56241), the \u003ccode\u003eorg_users.user_right\u003c/code\u003e column associated with the demoted user's account is not properly cleared.\u003c/li\u003e\n\u003cli\u003eThe demoted user exploits this oversight by continuing to invoke the \u003ccode\u003edelete_non_compliant_bundles\u003c/code\u003e and \u003ccode\u003ecount_non_compliant_bundles\u003c/code\u003e RPCs.\u003c/li\u003e\n\u003cli\u003eThe Capgo application, processing these RPCs, grants access based on the stale \u003ccode\u003esuper_admin\u003c/code\u003e privileges.\u003c/li\u003e\n\u003cli\u003eThe adversary successfully enumerates all non-compliant bundles within the organization.\u003c/li\u003e\n\u003cli\u003eThe adversary proceeds to bulk delete these non-compliant bundles across the entire organization.\u003c/li\u003e\n\u003cli\u003eThe objective is achieved, leading to unauthorized data manipulation and potential service disruption.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-56241 grants a demoted super_admin user the ability to perform indefinite and unauthorized enumeration and bulk deletion of non-compliant bundles across the entire Capgo organization. This can lead to severe data integrity issues, potential data loss, and significant service disruption by removing essential data assets. The CVSS v3.1 Base Score of 8.3 indicates a high severity risk, reflecting the critical impact on confidentiality, integrity, and availability. Organizations using affected Capgo versions face a substantial risk of malicious or accidental deletion of critical data by privileged insiders who should no longer possess such capabilities.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch CVE-2026-56241 immediately by upgrading Capgo to version 12.128.2 or later to ensure \u003ccode\u003eorg_users.user_right\u003c/code\u003e columns are properly cleared upon role demotion.\u003c/li\u003e\n\u003cli\u003eReview Capgo application logs for unexpected \u003ccode\u003edelete_non_compliant_bundles\u003c/code\u003e or \u003ccode\u003ecount_non_compliant_bundles\u003c/code\u003e RPC calls originating from demoted user accounts.\u003c/li\u003e\n\u003cli\u003eImplement robust auditing and alerting for critical administrative actions within Capgo, paying particular attention to bundle management operations by all users, especially recently demoted ones.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-12T12:22:03Z","date_published":"2026-07-12T12:22:03Z","id":"https://feed.craftedsignal.io/briefs/2026-07-capgo-privesc/","summary":"A privilege escalation vulnerability, CVE-2026-56241, in Capgo versions prior to 12.128.2 allows demoted super_admin users to retain access to critical RPCs, enabling them to indefinitely enumerate and bulk delete non-compliant bundles across an organization.","title":"Capgo Privilege Escalation via Retained Super_Admin Privileges (CVE-2026-56241)","url":"https://feed.craftedsignal.io/briefs/2026-07-capgo-privesc/"}],"language":"en","title":"CraftedSignal Threat Feed - Capgo","version":"https://jsonfeed.org/version/1.1"}