CVE-2026-56216: Capgo Privilege Escalation Vulnerability

CVE-2026-56216 Overview

CVE-2026-56216 is a privilege escalation vulnerability in Capgo versions before 12.128.2. The flaw resides in the POST /functions/v1/apikey endpoint, which fails to validate scope constraints when minting new API keys. An attacker holding a compromised app-limited API key can create an unrestricted key by submitting empty limits in the request payload. The newly minted key grants organization-wide access to protected resources, including app listings and other privileged endpoints. The vulnerability is classified under CWE-269: Improper Privilege Management.

Critical Impact
A low-privilege, app-scoped API key can be escalated into an unrestricted org-wide key, exposing all applications and protected endpoints within the affected Capgo organization.

Affected Products

Capgo versions prior to 12.128.2
Capgo self-hosted deployments exposing the /functions/v1/apikey endpoint
Capgo organizations using app-limited API keys for delegated access

Discovery Timeline

2026-06-20 - CVE-2026-56216 published to NVD
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2026-56216

Vulnerability Analysis

The vulnerability is a scope escalation flaw in Capgo's API key management function. Capgo issues API keys that can be limited to specific applications using a limited_to_apps (or equivalent) field. The POST /functions/v1/apikey endpoint accepts requests authenticated with an existing API key and creates a new key based on the caller's submitted parameters.

The endpoint does not enforce that a newly issued key inherits or remains within the scope of the calling key. An attacker authenticated with an app-limited key can submit a creation request containing empty or absent limit fields. The server accepts the request and returns a fully unrestricted key with org-wide privileges. This violates the principle of least privilege defined in [CWE-269].

Root Cause

The root cause is missing authorization enforcement on the key creation path. The endpoint validates that the caller possesses a valid API key but does not compare the requested scope of the new key against the scope of the caller. Empty limit values are interpreted as "no restrictions" instead of being rejected or constrained to the caller's existing boundaries.

Attack Vector

Exploitation requires network access to the Capgo API and possession of any valid app-limited API key. An attacker who obtains such a key through phishing, repository leakage, log exposure, or insider compromise sends an authenticated POST request to /functions/v1/apikey with empty limit fields. The response contains an unrestricted key that the attacker can then use to enumerate apps, retrieve releases, modify configuration, or pivot into other protected endpoints across the organization.

No verified proof-of-concept code is published. See the GitHub Security Advisory GHSA-2ff8-7h96-hwfp and the VulnCheck Advisory on API Key Escalation for vendor details.

Detection Methods for CVE-2026-56216

Indicators of Compromise

Requests to POST /functions/v1/apikey originating from app-limited keys where the response payload contains a key with no scope restrictions.
Unexpected API keys present in the Capgo organization that lack limited_to_apps or similar scoping fields.
API access patterns from a previously app-scoped client that suddenly include calls to organization-wide endpoints such as app listing routes.

Detection Strategies

Audit Capgo API key creation logs and flag any key minted by a scoped caller that resolves to an unrestricted scope.
Correlate source IP addresses and user agents across keys to identify a single client operating multiple keys with escalated privileges.
Compare the privilege level of each child key against its creator key in the key metadata store and alert on mismatches.

Monitoring Recommendations

Forward Capgo application and edge function logs to a centralized analytics platform for retention and querying.
Alert on bursts of requests to /functions/v1/apikey followed by access to high-value endpoints within a short time window.
Periodically inventory all active API keys and revoke any that lack documented business justification.

How to Mitigate CVE-2026-56216

Immediate Actions Required

Upgrade Capgo to version 12.128.2 or later on all self-hosted and managed deployments.
Rotate every API key issued by affected versions, prioritizing keys with org-wide scope.
Review API key creation logs since deployment and revoke any keys created through /functions/v1/apikey by a scoped caller.
Restrict network access to the Capgo API surface to known client IP ranges where feasible.

Patch Information

The vendor released the fix in Capgo 12.128.2. The patch enforces scope inheritance so that newly minted keys cannot exceed the privileges of the creating key. Operators should consult the GitHub Security Advisory GHSA-2ff8-7h96-hwfp for the exact commit references and upgrade procedure.

Workarounds

Disable or block the POST /functions/v1/apikey endpoint at the reverse proxy or WAF until the upgrade is complete.
Restrict API key creation to administrator accounts authenticated through a separate trusted channel.
Temporarily revoke all app-limited keys and reissue them only after upgrading to 12.128.2.

bash

# Example reverse proxy rule to block the vulnerable endpoint until patched
# nginx configuration snippet
location = /functions/v1/apikey {
    if ($request_method = POST) {
        return 403;
    }
}