CVE-2026-56329

Capgo - Cross-Tenant Preview Namespace Collision via Non-Bijective Underscore Decoding

State: Published
Severity: 5.3 Medium
Published: Jul 10, 2026
Updated: Jul 10, 2026
Reserved: Jun 20, 2026

Description

Capgo before 12.128.2 contains a cross-tenant preview namespace collision vulnerability caused by non-bijective decoding of double underscores to dots in preview hostname parsing. Attackers can register app IDs with underscores that collide with other tenants' dotted app IDs, causing preview misrouting and denial of preview access for victim applications.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L	VulnCheck
3.1	6.4 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L	VulnCheck

Weaknesses

CWE-436 Interpretation Conflict

Affected Products

Product	Versions
CapgoCapgo	before 12.128.2Affected 12.128.2Not affected

References

GitHub Security Advisory (GHSA-76qq-gg2p-pwwj)vendor-advisory
VulnCheck Advisory: Capgo - Cross-Tenant Preview Namespace Collision via Non-Bijective Underscore Decodingthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.