CVE-2026-56246: Capgo API Key Scope Bypass Allows Cross-Organization Deletion

Technical summary

The vulnerability is a broken access control issue (CWE-285) where scoped API keys with limited_to_orgs restrictions inherit the broader permissions of their owning user account. The authorization logic at the route level (rbac_check_permission_direct) evaluates user privileges before enforcing API key scope constraints, allowing a key restricted to Organization A to perform destructive operations against Organization B if the key's owner holds admin status in both organizations. The flaw affects DELETE endpoints for /organization and /organization/members, enabling cross-organization privilege escalation. The CVSS 3.1 score of 8.1 (HIGH) reflects the high integrity and availability impact in a network-accessible API with low attack complexity.

Business impact

Multi-tenant customers using Capgo face significant operational risk. An admin who creates a scoped API key for a legitimate purpose—such as granting CI/CD pipelines access to a single organization—inadvertently grants that key destructive power over their other organizations. In breach or misuse scenarios, this allows unauthorized deletion of organizations and member accounts across administrative boundaries. For managed service providers or enterprises managing multiple Capgo organizations, this threatens data integrity and operational continuity across customer or business unit silos.

Affected systems

Capgo versions prior to 12.128.2 are affected. The vendor_products field in the source data is empty, so verify affected versions and applicable deployment models (cloud-hosted vs. self-hosted) against the official Capgo security advisory.

Exploitability

Exploitability is moderate in terms of access requirements but high in impact. An attacker must hold valid admin credentials and an active API key (PR:L in the CVSS vector), but once obtained, the attack is straightforward: send HTTP DELETE requests to organization endpoints using a scoped key. No user interaction is required, and the network is directly accessible. The low complexity (AC:L) reflects that no special conditions or race conditions are needed—the flaw is deterministic. However, the attack requires legitimate (though misconfigured) API access, limiting opportunistic exploitation.

Remediation

Upgrade Capgo to version 12.128.2 or later. This patch corrects the authorization logic to enforce API key scope restrictions before evaluating user privileges. Organizations should audit existing API keys, especially those created with limited_to_orgs restrictions, and regenerate them after patching. Review audit logs for any suspicious cross-organization API activity prior to patching.

Patch guidance

Apply the update to Capgo 12.128.2 or later as soon as feasible given the HIGH severity rating. Before patching, document any API keys currently in use and their intended scopes. After patching, test scoped API keys in a staging environment to confirm that cross-organization operations are now properly blocked. Rotate all API keys created with limited_to_orgs scope to ensure they inherit the corrected permission model. Organizations operating multiple Capgo instances should prioritize patching instances with multi-organization administrative structures.

Detection guidance

Monitor API audit logs for DELETE requests to /organization or /organization/members endpoints using scoped API keys (those with limited_to_orgs attributes). Flag requests where the target organization differs from the API key's scope restriction. Check for unusual patterns of admin accounts creating multiple organizations or making unexpected cross-organization API calls. In pre-patch environments, correlate API key creation timestamps with subsequent cross-organization destructive actions to identify potential exploitation.

Why prioritize this

This vulnerability scores HIGH (8.1 CVSS) due to high integrity and availability impact combined with network accessibility and low attack complexity. The broken access control pattern is a foundational security issue in multi-tenant systems. Although exploitation requires valid credentials, the scope of potential damage—silent, authorized-looking deletion of entire organizations—warrants immediate attention. Organizations with multiple Capgo administrative accounts or complex organizational hierarchies face elevated risk.

Risk score, explained

The CVSS 3.1 score of 8.1 reflects: Network-accessible API (AV:N), low attack complexity requiring only valid credentials and an API key (AC:L, PR:L), no user interaction (UI:N), unchanged security scope (S:U), no confidentiality impact (C:N), but high integrity impact via organization and member deletion (I:H), and high availability impact through destructive operations (A:H). This puts the vulnerability firmly in the HIGH band, justifying urgent patching despite the authentication requirement.

Frequently asked questions