CVE-2026-56295: Capgo API Key Policy Bypass in Webhook Management

Technical summary

The vulnerability exists in Capgo's webhook management endpoints, specifically in the checkWebhookPermission authorization function. This function validates whether a user has permission to perform webhook operations but fails to invoke apikeyHasOrgRightWithPolicy during its permission checks. As a result, API keys lacking an expiration date bypass the organization's require_apikey_expiration policy, allowing holders of legacy non-expiring keys to perform webhook operations that should be restricted. The authorization bypass is a logic flaw rather than a cryptographic weakness; it's a missing validation step in the permission-checking chain. The affected operations include listing webhooks, creating new webhooks, and deleting existing webhooks.

Business impact

For organizations that have adopted a non-expiring API key ban as part of their security posture, this vulnerability creates a compliance gap. Users or services holding grandfather API keys can circumvent the intended control, leaving persistent credentials in circulation that your policy was designed to eliminate. Webhooks often serve as bridge points between your application and external systems or internal automation; unauthorized creation or deletion could lead to silent failures in integrations, missed alerts, or unexpected data flows. An insider or compromised account with legacy credentials could delete critical webhooks, disrupting operational workflows. The impact is primarily on enforcement of your own security governance rather than direct data exposure, though unauthorized webhook manipulation could indirectly affect data flow integrity.

Affected systems

Capgo installations running version 12.128.1 and earlier are vulnerable. The issue affects any organization that has enabled or relied on the require_apikey_expiration policy to control API key lifecycle. Any API key in your environment that lacks an expiration date can exploit this vulnerability; systems or users authenticating with such keys can perform unrestricted webhook operations regardless of policy. Verify your installed Capgo version and review whether you have organization-level API key expiration policies in place to determine exposure.

Exploitability

Exploitation requires authenticated access—an attacker must already possess a valid, non-expiring API key or credentials to an account that holds such a key. The attack surface is internal or supply-chain focused rather than unauthenticated internet-facing. Once an attacker has a legacy API key, the vulnerability is trivial to exploit: standard webhook API calls will succeed despite organizational policy. There is no complexity barrier; the missing policy check means no additional tricks or race conditions are needed. The CVSS score of 6.3 reflects the authentication requirement and limited scope (user-level impact), but the ease of exploitation and the direct policy bypass increase practical risk within organizations that trust their credential hygiene.

Remediation

Upgrade Capgo to version 12.128.2 or later to receive the corrected authorization logic. Before upgrading, audit your organization's API keys and identify any non-expiring keys still in use. If feasible, rotate non-expiring keys to new expiring credentials and retire the old ones. After patching, test that webhook endpoints correctly reject operations from non-expiring API keys when the require_apikey_expiration policy is active. Review audit logs for any unauthorized webhook creation, deletion, or listing operations that may have occurred while the vulnerability was present.

Patch guidance

Apply Capgo version 12.128.2 or later. This version restores the apikeyHasOrgRightWithPolicy validation step in the checkWebhookPermission function, ensuring that organization-level API key policies are enforced at the webhook endpoint layer. Test in a staging environment first to confirm that webhook operations respect your configured policies and that no legitimate automation is disrupted. Verify that existing non-expiring API keys are indeed blocked from webhook operations post-patch, and prioritize rotation of any legacy non-expiring credentials in your environment.

Detection guidance

Monitor Capgo webhook API logs for requests authenticated with API keys that lack an expiration date. Look for anomalous patterns: creation of new webhooks, bulk deletion of webhooks, or listing of webhooks by service accounts or users who should not have that access. If you have recently enforced the require_apikey_expiration policy, check for webhook operations by keys that predate that enforcement, as they may represent exploitation. Compare the list of active non-expiring API keys against your organization's intended credential inventory; any unexpected key should be investigated and revoked.

Why prioritize this

This vulnerability merits medium priority in most environments. While it requires authentication and the real-world impact depends on whether you have actually deployed a non-expiring API key ban, it directly undermines a reasonable security control. If your organization has set an explicit policy forbidding non-expiring keys, this vulnerability means that policy is ineffective for a critical integration surface (webhooks). Prioritize patching if you have adopted API key expiration policies, active non-expiring legacy keys in production, or rely on webhooks for critical integrations. In environments without such policies or with limited webhook usage, patching is still important but can follow routine maintenance windows.

Risk score, explained

The CVSS 6.3 (Medium) score reflects: authenticated access required (PR:L), reducing attack surface to insiders or compromised accounts; network-accessible endpoint (AV:N) and low attack complexity (AC:L); and limited scope (S:U) with integrity and availability impact (I:L, A:L) through unauthorized webhook manipulation, plus minor confidentiality loss if webhook details are exposed. The score does not account for the organizational context (whether you have actually deployed the policy being bypassed) or the operational criticality of webhooks in your environment; adjust your internal risk assessment accordingly.

Frequently asked questions