---
id: CVE-2026-56227
title: Capgo - Server-Side Request Forgery via Webhook URL Validation
summary: >-
  Capgo before 12.128.2 contains a server-side request forgery vulnerability in
  webhook URL validation that allows loopback and internal addresses.
  Organization admins can configure webhooks pointing to localhost or 127.0.0.1,
  and when tri…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-918
vendor: Capgo
product: Capgo
affected:
  - Capgo < 12.128.2
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-06-22T12:44:56.936882Z'
exploitAvailable: true
published: '2026-06-20'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:05:38.180Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-56227'
references:
  - url: 'https://github.com/Cap-go/capgo/security/advisories/GHSA-48hc-53hv-6x3f'
    label: GitHub Security Advisory (GHSA-48hc-53hv-6x3f)
  - url: >-
      https://www.vulncheck.com/advisories/capgo-server-side-request-forgery-via-webhook-url-validation
    label: >-
      VulnCheck Advisory: Capgo - Server-Side Request Forgery via Webhook URL
      Validation
tags:
  - cve.org
  - exploit-available
epss: 0.0026
epssPercentile: 0.1784
ingestedAt: '2026-11-08T14:51:22.367Z'
---

## Overview

Capgo before 12.128.2 contains a server-side request forgery vulnerability in webhook URL validation that allows loopback and internal addresses. Organization admins can configure webhooks pointing to localhost or 127.0.0.1, and when triggered, the backend performs outbound requests to these addresses with error responses disclosed to users.

## Affected

- `Capgo < 12.128.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.