Read the docs
TI-2026-40601 Aliases CVE-2026-56236GHSA-4ch8-prch-6prf

Capgo CLI - Arbitrary File Overwrite via Symlink-Following in Local Credential Operations

Priority MEDIUM 63CWE-59Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Capgo CLI before 12.128.2 contains arbitrary file overwrite vulnerabilities in login and build credentials operations that follow symlinks without validation. Attackers can create malicious symlinks in repositories to overwrite arbitrary files or expose credentials with world-readable permissions when developers run the CLI.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00183 7th percentileScored 2026-11-07
Fix Fixed cli (capgo): 12.128.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Capgoclibefore 12.128.212.128.2Patch availableCNA
  • cli VendorCapgo Affected before 12.128.2 Fixed in 12.128.2 Patch available CNA

Remediation

  • Fix · CNA cli (capgo) Fixed in 12.128.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-56236
  2. 2026-10-03 Alias added: GHSA-4ch8-prch-6prf

References

Advisory 1

  • TI-2026-40602 Capgo - Unauthenticated API Key Generation via Client-Side Parameter Manipulation CVSS 4.0CRITICAL 9.3
  • TI-2026-40473 Cap-go - Account Lockout via 2FA Misconfiguration on Unverified Email CVSS 4.0CRITICAL 9.3
  • TI-2026-40465 Cap-go - OTP Bypass via Response Manipulation in Email Verification CVSS 4.0CRITICAL 9.3
  • TI-2026-64782 capgo.app through 12.129.0 Cache Restoration of Deleted Bundles CVSS 4.0HIGH 8.7
  • TI-2026-40704 Capgo - Unauthenticated Organization Existence Enumeration via rescind_invitation RPC CVSS 4.0HIGH 8.7
  • TI-2026-40689 Capgo - Rate Limit Bypass via User-Controlled device_id Parameter CVSS 4.0HIGH 8.8
See all 124 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences