HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-56257 — Capgo before 12.128.2 allows direct patching of public.apps.owner_org through Po...

·Source: NIST NVD

Updated:

Executive Summary

Capgo before 12.128.2 allows direct patching of public.apps.owner_org through PostgREST, bypassing the transfer_app() workflow and creating split-brain ownership. Attackers can directly update apps.owner_org while leaving app_versions.owner_org unchanged, enabling old-org keys to retain access to version data while new-org keys control the app record.

Analysis

Capgo before 12.128.2 allows direct patching of public.apps.owner_org through PostgREST, bypassing the transfer_app() workflow and creating split-brain ownership. Attackers can directly update apps.owner_org while leaving app_versions.owner_org unchanged, enabling old-org keys to retain access to version data while new-org keys control the app record. CVSS Score: 7.1. Published: 2026-06-24T13:16:35.123.

Indicators of Compromise (1)

CVE (1)
CVE-2026-56257
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Jun 24, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

US FTC Eyes AI Model Behavior in New Policy Push

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/us-ftc-eyes-ai-model-behavior-in-new-policy-push-image_small-1-a-32135.jpg" align=right hspace=4><b>Agency Seeks Comments on Objectivity, Accuracy and AI Governance</b><br>The FTC has opened a public comment period on whether AI companies improperly shape model behavior. The proposal could redefine how federal regulators oversee A

Bank Info Security
MEDIUMVulnerabilityNEW

The Shadow AI Problem Starts in the C-Suite

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/shadow-ai-problem-starts-in-c-suite-image_small-9-a-32133.jpg" align=right hspace=4><b>Executives Are More Likely to Use Unapproved AI Tools Than Their Teams</b><br>Shadow AI may look like a rank-and-file problem, but new data suggests the biggest users of unauthorized tools are senior leaders and C-suite executives. The findings

Bank Info Security
MEDIUMVulnerability

Workers Withdraw Claims in Stryker Wiper Attack Lawsuit

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/court-dismisses-stryker-hack-lawsuit-filed-by-workers-image_small-10-a-32129.jpg" align=right hspace=4><b>Action Comes After Stryker Contends Employees' Personal Data Wasn't Compromised</b><br>Eight current and former Stryker employees of medical tech company voluntarily withdrew their lawsuits against the medical technology compa

Bank Info Security