CVE Watch13 jul 2026

CVE-2026-56240

Capgo before 12.128.12 contains a billing authorization bypass vulnerability in the plan_valid calculation that allows organizations with ex

CVSS

4.3

Medio

EPSS

0.3%

p23

KEV

—

Exploit Today

0-100

Publicado: 11 jul 2026 · Última mod.: 13 jul 2026 · CWE-285

EPSS · 30d

0.2%EPSS · 30 días0.3%

2026-08-132026-09-09

Descripción técnica

Capgo before 12.128.12 contains a billing authorization bypass vulnerability in the plan_valid calculation that allows organizations with exhausted or expired usage credit grants to bypass billing gates. Attackers can exploit the divergence between the plugin hot-path plan_valid expression and the authoritative billing gate to gain continued access to /updates, /stats, /channel_self, and attachment upload endpoints after credit depletion.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-804368.5 ALT

—

———IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service by deleting arbitrary RabbitMQ queues or exchanges due to improper authorization.6h CVE-2026-803788.5 ALT

—

———IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service due to improper authorization.6h CVE-2026-855434.3 MED

—

———Some Wi-Fi series camera products have insufficient permission validation on certain interfaces, allowing authenticated low-privileged users to obtain device Wi-Fi configuration information through these interfaces.13h CVE-2026-210976.7 MED

2.8%

——1Improper authentication in ActivityTaskManagerService prior to SMR Sep-2026 Release 1 allows local privileged attackers to launch arbitrary activity.8h CVE-2026-868045.3 MED

31.4%

——9A vulnerability was identified in seakee CPA-Manager-Plus up to 1.11.10. This vulnerability affects the function CPAResource of the file apps/manager-server/internal/http/controller/proxy/handler.go of the component HTTP Handler. The manipulation leads to improper authorization. It is possible to initiate the attack remotely. Upgrading to version 1.11.11 is able to resolve this issue. The identifier of the patch is 842eec791377ddcbea5cd639bc065eaa4801d656. It is suggested to upgrade the affected component.2d CVE-2026-586117.8 ALT

12.3%

——4Improper authorization in XBox Gaming Services allows an authorized attacker to elevate privileges locally.2d