CVE-2026-100628
Received Received - Intake

API Key Expiration Bypass in Capgo App

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
capgo.app before 12.128.12 fails to enforce an organization's API key expiration policy when creating app-scoped API keys. In the POST /apikey endpoint, requests that supply app_id but omit org_id, limited_to_orgs, and expires_at resolve the target app and scope the key to it, but never add the app's owner organization to the list of organization IDs passed to validateExpirationAgainstOrgPolicies; because that list is empty, the validation returns early. As a result, an authenticated organization member can create a non-expiring app-scoped API key even when the owning organization has require_apikey_expiration enabled and a max_apikey_expiration_days limit configured. The issue is fixed in version 12.128.12.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100628
EUVD
EUVD-2026-87722

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
capgo app to 12.128.12 (inc)
capgo capgo.app to 12.128.12 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-100628 is an authorization bypass in the Capgo application where authenticated organization members can create app-scoped API keys that never expire, even when the organization enforces expiration policies. This happens when creating API keys without specifying org_id, limited_to_orgs, or expires_at parameters. The app resolves the target app but fails to include the owner organization in validation, bypassing expiration checks.

Detection Guidance

To detect this vulnerability, check for app-scoped API keys created without expiration dates in your Capgo application. Review API key creation logs for requests to POST /apikey that include app_id but omit org_id, limited_to_orgs, and expires_at parameters. Verify if any keys bypass expiration policies by inspecting the validateExpirationAgainstOrgPolicies function behavior.

Impact Analysis

This vulnerability allows attackers to create long-lived API keys that persist indefinitely, undermining key rotation, offboarding, and incident response controls. Organizations relying on API key expiration policies may face unauthorized access risks, data breaches, or compliance violations due to uncontrolled API key lifespans.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA by allowing uncontrolled access to sensitive data through non-expiring API keys. Organizations may fail to enforce proper access controls, risking data breaches and violating regulatory requirements for data protection and access management.

Mitigation Strategies

Immediately upgrade to Capgo version 12.128.12 or later to address the vulnerability. Review and revoke any non-expiring app-scoped API keys created before the update. Enforce strict validation by ensuring all API key creation requests include org_id and expires_at parameters. Monitor for unauthorized API key creation attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100628. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart