CVE-2026-100615
Received Received - Intake

Privilege Escalation via API Key Rotation in Cap-go

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
Cap-go capgo.app before 12.267.1 fails to validate target API key privilege during rotation, allowing an apikey_manager to rotate a higher-privileged org_super_admin sibling key and recover its plaintext credential. Attackers with apikey_manager role can enumerate same-owner API keys, rotate a stronger sibling through the PUT endpoint, and obtain the replacement plaintext secret to authenticate as the higher-privileged principal.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100615
EUVD
EUVD-2026-87710

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
cap-go capgo.app to 12.267.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-100615 is a privilege escalation flaw in Cap-go's capgo.app before version 12.267.1. It allows an API key manager to rotate a sibling key with higher privileges (like org_super_admin) and recover its plaintext credential. The system fails to validate target API key privilege during rotation, enabling attackers to escalate their access level.

Detection Guidance

Check for unauthorized API key rotations in logs, particularly for higher-privileged roles like org_super_admin. Monitor PUT requests to the API key rotation endpoint and verify privilege containment checks are enforced. Look for plaintext credential exposure in logs or storage.

Impact Analysis

If you are an apikey_manager, an attacker could exploit this to escalate their privileges to org_super_admin by rotating a higher-privileged sibling key and obtaining its plaintext secret. This allows unauthorized access to sensitive functions and data under the higher-privileged account.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations using affected versions may face compliance breaches, legal penalties, and reputational damage due to potential data exposure.

Mitigation Strategies

Upgrade capgo.app to version 12.267.1 or later. Implement strict privilege containment checks during API key rotation to prevent higher-privileged key access. Restrict apikey_manager role permissions and audit existing API keys for suspicious rotations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100615. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart