Executive Summary

CVE-2026-56225 is an authorization bypass vulnerability in Capgo versions before 12.128.2 affecting its public API key management handlers (get, put, delete, post).

API keys created with mode=all but restricted to a single app via limited_to_apps are only checked for limited_to_orgs and not for limited_to_apps. This means an app-scoped key can access, enumerate, update, and delete sibling API keys belonging to the same account that are outside its declared app scope.

This flaw enables tampering with account-level credentials, allowing unauthorized management of API keys beyond the intended app restrictions.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker who has an app-limited all API key to enumerate, modify, or delete sibling API keys outside the intended app scope within the same account.

Such unauthorized access can lead to tampering with account-level credentials, disruption of workflows, and potentially broader account compromise.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Capgo to version 12.128.2 or later, where the issue has been patched.

Additionally, review and restrict API keys that use mode=all but are limited to a single app via limited_to_apps, as these keys are vulnerable to authorization bypass.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in Capgo allows unauthorized enumeration, modification, and deletion of API keys beyond their intended app scope, leading to potential tampering with account-level credentials.

Such unauthorized access and privilege escalation could result in exposure or alteration of sensitive data, which may violate data protection requirements under standards like GDPR and HIPAA that mandate strict access controls and protection of personal and sensitive information.

Therefore, this vulnerability could negatively impact compliance with these regulations by enabling improper privilege management and access control failures.

Useful 0 Not Useful 0