Home

Description

Capgo before 12.128.2 contains an html injection vulnerability in the organization settings endpoint that allows attackers to inject malicious HTML content. Attackers can craft payloads in the organization name field to redirect users to untrusted websites, enabling phishing attacks and reputational damage.

PUBLISHED Reserved 2026-06-20 | Published 2026-07-08 | Updated 2026-07-08 | Assigner VulnCheck




MEDIUM: 4.8CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
MEDIUM: 5.4CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Problem types

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Product status

Default status
unaffected

Any version before 12.128.2
affected

12.128.2 (semver)
unaffected

Credits

Cyberheroes1010 reporter

References

github.com/.../capgo/security/advisories/GHSA-vhvc-gxfh-m85g exploit

github.com/.../capgo/security/advisories/GHSA-vhvc-gxfh-m85g (GitHub Security Advisory (GHSA-vhvc-gxfh-m85g)) vendor-advisory

www.vulncheck.com/...en-redirection-in-organization-settings (VulnCheck Advisory: Capgo - HTML Injection Leading to Open Redirection in Organization Settings) third-party-advisory

cve.org (CVE-2026-56283)

nvd.nist.gov (CVE-2026-56283)

Download JSON