Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.2
CVE-2026-56241: Capgo - Demoted Admins Still Have Deletion Privileges
CVE-2026-56241
CVE-2026-56241
Summary
A security issue in Capgo versions before 12.128.2 allows attackers to delete sensitive files in an organization even after the attacker's admin privileges have been removed. This is because the system doesn't immediately remove the old privileges, allowing the attacker to keep deleting files. You should update to the latest version of Capgo to fix this issue.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| capgo | capgo | < 12.128.2 |
Original title
Capgo - RBAC Demotion Privilege Retention via Stale org_users.user_right
Original description
Capgo before 12.128.2 contains a privilege escalation vulnerability where demoted super_admin users retain access to delete_non_compliant_bundles and count_non_compliant_bundles RPCs due to stale org_users.user_right column not being cleared during role binding deletion. Attackers can exploit this by maintaining a previously granted super_admin role to enumerate and bulk delete non-compliant bundles across the entire organization indefinitely.
nvd CVSS3.1
8.3
nvd CVSS4.0
7.2
Vulnerability type
CWE-285
Improper Authorization
Published: 12 Jul 2026 · Updated: 20 Jul 2026 · First seen: 12 Jul 2026