CVE-2026-56246
HighCVSS 8.1Summary
A broken access control vulnerability in Capgo before version 12.128.2 allows a scoped API key (limited_to_orgs) to inherit its owner's user permissions, enabling destructive cross-organization actions. A write-mode API key restricted to one organization can still perform operations like DELETE /organization or DELETE /organization/members against another organization.
Risk Assessment
The organization is at risk of unauthorized deletion of organizations or their members via an API key that should be restricted to a single organization. This could lead to data loss and service disruption.
Recommendation
Immediately upgrade Capgo to version 12.128.2 or later. After upgrading, verify API key configurations and user permissions across organizations.
Original NVD description (English source)
Capgo before 12.128.2 contains a broken access control vulnerability in the organization management API where a scoped API key (limited_to_orgs) inherits its owner-user's permissions, allowing destructive cross-organization actions. When a user is an admin in two organizations and creates a write-mode API key restricted to one organization, that key can still perform destructive operations (e.g., DELETE /organization, DELETE /organization/members) against another organization. The root cause is route-level authorization (rbac_check_permission_direct) that evaluates the key owner's user privileges before enforcing the API key's limited_to_orgs scope.