CVE-2026-56216: Capgo API Key Scope Escalation Vulnerability (CVSS 8.8)

Technical summary

CVE-2026-56216 is an improper authorization vulnerability (CWE-269) in the POST /functions/v1/apikey endpoint of Capgo. The endpoint fails to properly validate or enforce scope restrictions when processing key creation requests. By submitting a malformed request with empty limit fields, an authenticated attacker can bypass the intended scope constraints on app-limited keys and create keys with unrestricted permissions. The vulnerability affects all versions prior to 12.128.2 and requires valid API credentials to exploit, indicating a post-authentication privilege escalation vector.

Business impact

A compromised app-limited API key becomes a pivot point for organizational compromise. Attackers can leverage the scope escalation to access sensitive application metadata, licensing information, and other protected resources across the entire organization. This increases the blast radius of any single key compromise from a narrow, application-specific scope to organization-wide visibility and potential for lateral movement or unauthorized changes to app configurations.

Affected systems

Capgo versions prior to 12.128.2 are affected. The vulnerability impacts any deployment relying on app-limited API keys for least-privilege access control. Organizations using API keys with intentionally restricted scopes should assume those restrictions may be bypassable if the keys have been exposed or compromised in any way.

Exploitability

Exploitation requires prior compromise or access to a valid app-limited API key. The attack itself is trivial once credentials are obtained—it involves a single HTTP POST request with empty limit parameters to the key minting endpoint. No special tools or complex techniques are required, and the vulnerability can be exploited over the network. The primary barrier to exploitation is obtaining an initial valid API credential, but once breached, the scope escalation is straightforward.

Remediation

Immediately upgrade Capgo to version 12.128.2 or later. After patching, review API key usage patterns and audit logs to identify whether any unusual key creation activity occurred during the window when affected versions were in use. Revoke any API keys that cannot be confirmed as legitimately created, and implement monitoring on the key creation endpoint to detect similar exploitation attempts in the future.

Patch guidance

Apply Capgo version 12.128.2 or later to all affected installations. The patch addresses the authorization logic in the POST /functions/v1/apikey endpoint to properly enforce scope restrictions regardless of input parameters. Test the upgrade in a non-production environment first to verify compatibility with your deployment. Verify the upgrade was successful by confirming the application version and testing API key creation with intentionally restricted scopes to ensure limits are enforced.

Detection guidance

Monitor audit logs for POST requests to the /functions/v1/apikey endpoint that result in key creation with unrestricted or unexpectedly broad permissions. Alert on suspicious patterns such as app-limited keys being used to create organization-wide keys, or multiple failed key creation attempts followed by successful ones with elevated scope. Network detection should flag any unusual API activity from compromised keys, particularly requests to protected endpoints that fall outside the key's intended scope.

Why prioritize this

This vulnerability merits urgent attention due to its combination of high CVSS score (8.8), ease of exploitation once credentials are compromised, and the organizational impact of scope escalation. While it requires valid credentials, the near-zero effort required to exploit it means any key compromise immediately becomes critical. The threat is heightened if your organization uses API keys for programmatic access or if keys have been stored in version control, logs, or other locations where they may be accessible to attackers.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects a network-accessible vulnerability with low attack complexity and no user interaction required. While exploitation requires low-privilege authenticated access, the impact is severe: compromised confidentiality, integrity, and availability across organization-wide resources. The unrestricted scope of the escalated key means an attacker gains equivalent access to an organization administrator from a single compromised limited key, justifying the high severity rating.

Frequently asked questions