CVE-2026-56225: Capgo API Key Authorization Bypass (CVSS 8.3)

Technical summary

The vulnerability exists in Capgo's public API key management endpoints (handling get, put, delete, and post operations). API keys created with mode=all but constrained via limited_to_apps parameter are validated only against limited_to_orgs, not against limited_to_apps. This means authentication and authorization checks are incomplete. An attacker with a legitimately-scoped app API key can make requests against the key management API that should be denied (accessing sibling keys outside its app scope). The authorization bypass is not a network-level issue but an application logic flaw in the permission-checking layer. CWE-269 (Improper Access Control) is the underlying weakness class.

Business impact

API key compromise and unauthorized manipulation directly threaten account security. If an attacker gains access to an app-scoped API key—through phishing, supply chain compromise, or code repository exposure—they can escalate privileges by discovering and tampering with account-level credentials. This enables lateral movement within a Capgo deployment, potential access to other applications managed by the same organization, and disruption of CI/CD or deployment pipelines that rely on API key-based authentication. For SaaS customers and mobile app teams using Capgo for build and deployment automation, this represents a path to deploy malicious code or intercept sensitive build artifacts.

Affected systems

Capgo versions prior to 12.128.2 are affected. The vulnerability applies specifically to API key management interfaces and does not directly affect end-user facing features; however, any deployment using Capgo's public API with restricted API keys is potentially vulnerable if those keys are used in automated workflows or CI/CD integrations.

Exploitability

Exploitation requires a valid API key scoped to at least one application (limited_to_apps), but no additional authentication is needed beyond that already-compromised key. The attack is straightforward: use the app-scoped key to call key management endpoints (list, read, update, delete) against other keys in the account. No user interaction is needed, network access is required but typically available (API is public-facing), and no complex conditions must align. The attack surface is the API itself, accessible to anyone who has obtained a scoped credential. Ease of exploitation is high once key access is gained.

Remediation

Upgrade Capgo to version 12.128.2 or later. This patch adds proper validation of the limited_to_apps parameter in the key management authorization checks, ensuring that app-scoped keys cannot operate outside their designated scope. Administrators should verify that all instances are running the patched version. Post-upgrade, review API key usage logs for any suspicious activity (queries or modifications to keys outside expected scopes) and consider rotating API keys that may have been exposed or used in untrusted environments.

Patch guidance

Apply Capgo version 12.128.2 or later. Test the upgrade in a non-production environment first to ensure compatibility with your CI/CD and deployment automation. After upgrading, verify that your existing API key integrations continue to function as expected—legitimate app-scoped operations should work, but any that were inadvertently relying on the authorization bypass will fail (which is desired behavior). Review your API key management practices: ensure keys are created with the minimum scope necessary for their intended use, rotate keys regularly, and avoid sharing keys across multiple applications or environments.

Detection guidance

Monitor API access logs for unusual patterns: requests from app-scoped API keys to key management endpoints (especially listing, reading, or modifying other keys), followed by attempts to use or delete those keys. Look for a single API key making requests against multiple unrelated app resources or attempting key enumeration. If you have audit logging enabled, check for failed authorization attempts on key management operations—these may indicate exploitation attempts. Correlate key creation timestamps with unusual account activity. Additionally, inspect your API key inventory for keys with overly broad scopes (mode=all with weak app restrictions) that might be easier targets.

Why prioritize this

This vulnerability scores CVSS 8.3 (HIGH) due to the combination of high confidentiality and integrity impact (exposure and modification of account credentials) and the low barrier to exploitation if an app-scoped key is already compromised. Account-level credential tampering can cascade into broader account takeover. However, exploitation requires prior possession of at least one valid API key, which limits the attack surface in some deployments but makes it a critical issue for any environment where API keys are generated, shared, or used in automated systems. The lack of KEV/CISA tracking does not diminish the risk to organizations relying on Capgo for deployment automation.

Risk score, explained

CVSS 8.3 reflects: (1) Network-accessible API with low authentication complexity (the attacker must have one valid key, which is a prerequisite, not a strength of the system); (2) High impact on confidentiality (API keys are sensitive credentials whose exposure compromises account security) and integrity (the ability to modify or delete other keys enables account takeover); (3) Limited availability impact (deletion of keys may disrupt services but is not the primary impact vector). The scope is unchanged (internal to the Capgo account). This is a privileged-user-to-broader-privilege escalation scenario, justifying HIGH severity and mandating prompt patching.

Frequently asked questions