HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-56244 — Capgo before 12.128.2 allows non-admin API keys to read webhook signing secrets ...

·Source: NIST NVD

Updated:

Executive Summary

Capgo before 12.128.2 allows non-admin API keys to read webhook signing secrets via Supabase REST due to insufficient row-level security policies on the webhooks table. Attackers can retrieve the webhook secret and forge valid X-Capgo-Signature headers to send authenticated webhook events to configured receivers, breaking webhook authenticity and integrity.

Analysis

Capgo before 12.128.2 allows non-admin API keys to read webhook signing secrets via Supabase REST due to insufficient row-level security policies on the webhooks table. Attackers can retrieve the webhook secret and forge valid X-Capgo-Signature headers to send authenticated webhook events to configured receivers, breaking webhook authenticity and integrity. CVSS Score: 7.1. Published: 2026-06-24T13:16:33.597.

Indicators of Compromise (1)

CVE (1)
CVE-2026-56244
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Jun 24, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerability

UK investors sue Binance

Nearly 1700 UK investors have filed a group action legal claim seeking at least £150 million from crypto platform Binance and its founder Changpeng Zhao.

Finextra
MEDIUMVulnerability

Danske Bank extends AWS partnership for AI push

Denmark’s Danske Bank is expanding its collaboration with Amazon Web Services as it bids to accelerate the rollout of AI-enabled products and services.

Finextra
MEDIUMVulnerability

Instant business payments platform Root emerges from stealth

Root, an instant payments platform that powers receivables, payables, and money transmissions, has emerged from stealth with a mission to modernise money movement in the US.

Finextra