EUVD-2026-42252
GHSA-pjwf-764c-cr9c
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered stored injection (AV:N, AC:L), requires low-privilege auth (PR:L), victim must view the page (UI:R), scope changes to victim browser (S:C), limited confidentiality/integrity impact via phishing redirect (C:L/I:L), no availability impact.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Capgo before 12.128.2 contains an html injection vulnerability in the organization settings endpoint that allows attackers to inject malicious HTML content. Attackers can craft payloads in the organization name field to redirect users to untrusted websites, enabling phishing attacks and reputational damage.
AnalysisAI
HTML injection in Capgo's organization settings endpoint allows an authenticated attacker to embed malicious HTML into the organization name field, redirecting other users to attacker-controlled phishing sites. Affected versions are all Capgo releases prior to 12.128.2. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must hold a valid, authenticated Capgo account with write permission to the organization settings endpoint - corresponding to PR:L in the CVSS 4.0 vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 4.8 (Medium) accurately reflects limited real-world impact: PR:L confirms authentication is required, and UI:A means a victim must actively view the poisoned organization page - exploitation is not fire-and-forget. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a low-privileged Capgo account navigates to the organization settings page and sets the organization name to a crafted HTML string containing a redirect anchor or meta-refresh tag pointing to a phishing domain. When other organization members subsequently view any page that renders the organization name (such as the dashboard or team management page), their browser follows the injected redirect, landing them on an attacker-controlled site designed to harvest credentials. … |
| Remediation | Upgrade Capgo to version 12.128.2 or later, which resolves the HTML injection by properly sanitizing or encoding the organization name field before rendering. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today