CVE-2026-88862
Deferred Deferred - Pending Action

Privilege Escalation in Capgo Backend via Key ID Spoofing

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: VulnCheck

Description
Capgo (capgo.app) backend through 12.242.4 does not validate parent-child delegation when processing the x-limited-key-id header. checkKeyByIdPg() in supabase/functions/_backend/utils/hono_middleware.ts resolves the attacker-supplied numeric API key ID using only the key ID, its expiration state, and the authenticating key's user_id, while hasLimitedRbacSubkeyScope() accepts any key with a non-organization (e.g., app-scoped) RBAC binding and validateSubkeyUser() only compares owning user IDs. Because Capgo treats API keys as independent RBAC principals with separate role bindings, an authenticated apikey_manager API key with no application access can supply the numeric ID of a more privileged same-owner key and have the middleware replace the authenticated principal and effective API-key secret with that key (setSubkeyAuthContext), exercising an app_admin sibling's permissions without knowing or submitting its secret. The issue was reproduced on release 12.242.4 (commit b3d02cdbc23ac59990785acacd1f113c07458568) after the fix for GHSA-8h52-44r7-w343; at the time of the advisory no patched version was available.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-10
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-88862
EUVD
EUVD-2026-75412

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
capgo capgo to 12.242.4 (exc)
capgo backend to 12.242.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-88862 is an authentication bypass flaw in Capgo's backend (versions up to 12.242.4). It allows an attacker with a valid apikey_manager key to impersonate a more privileged same-owner API key by supplying its numeric ID via the x-limited-key-id header. The backend fails to validate parent-child delegation, enabling privilege escalation without knowing the privileged key's secret.

Detection Guidance

To detect this vulnerability, inspect HTTP requests containing the x-limited-key-id header in your Capgo backend logs. Look for requests where an apikey_manager key attempts to use a sibling key's ID to escalate privileges. Check for unauthorized privilege escalation events or actions performed by keys not matching the original authenticated principal.

Impact Analysis

An attacker could gain elevated permissions (e.g., app_admin) to perform unauthorized actions like modifying application settings, managing OTA bundles, or altering channels. Exploitation requires only a valid apikey_manager key and knowledge of a sibling key ID, without needing the sibling's secret or database access.

Compliance Impact

This vulnerability could lead to unauthorized access and modification of sensitive data, violating confidentiality and integrity requirements in GDPR and HIPAA. Organizations using affected Capgo versions may face compliance violations due to potential data breaches or unauthorized changes to protected information.

Mitigation Strategies

Immediately upgrade to Capgo backend version 12.258.0 or later, which includes the fix in PR #3196. Revoke all apikey_manager keys and regenerate them after the upgrade. Audit all API keys for unauthorized privilege escalation attempts and restrict RBAC bindings to enforce proper delegation containment.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88862. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart