CVE-2026-56225: Capgo Auth Bypass Vulnerability

CVE-2026-56225 Overview

CVE-2026-56225 is an authorization bypass vulnerability in Capgo versions prior to 12.128.2. The flaw resides in the public API key management handlers responsible for get, put, delete, and post operations. API keys created with mode=all but restricted to a single application via limited_to_apps are validated only against limited_to_orgs, not against limited_to_apps. An attacker holding an app-scoped key can enumerate, update, and delete sibling API keys belonging to the same account, including keys outside its declared application scope. This breaks tenant isolation at the account level and exposes account-wide credentials to tampering.

Critical Impact
An app-scoped API key can tamper with account-level credentials, enabling privilege escalation across applications under the same organization.

Affected Products

Capgo versions prior to 12.128.2
Capgo public API key management handlers (get/put/delete/post)
API keys created with mode=all and limited_to_apps scoping

Discovery Timeline

2026-06-23 - CVE-2026-56225 published to the National Vulnerability Database (NVD)
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-56225

Vulnerability Analysis

The vulnerability is an authorization bypass classified under [CWE-269] Improper Privilege Management. Capgo's public API enforces scoping on API keys through two attributes: limited_to_orgs and limited_to_apps. When a key is created with mode=all and constrained to a specific application via limited_to_apps, the API key management endpoints check only the organization scope during authorization decisions. The application scope is never evaluated for the management operations themselves.

As a result, a key intended to operate against a single application can list, modify, or remove other API keys associated with the same parent account. Attackers can pivot from a limited app-scoped credential to broader account-level access, including the ability to delete sibling keys or replace them with attacker-controlled values.

Root Cause

The root cause is a missing authorization check in the API key management handlers. The handlers consult limited_to_orgs to confirm organization membership but omit the corresponding evaluation against limited_to_apps. Because the scope contract is implied by both fields, validating only one collapses the security boundary between applications within the same account.

Attack Vector

Exploitation requires network access to the Capgo API and possession of a low-privilege API key issued with mode=all and constrained via limited_to_apps. The attacker calls the API key management endpoints against key identifiers outside the declared app scope. Because the handlers do not reject the cross-app request, the operation succeeds. No user interaction is required. See the GitHub Security Advisory and the VulnCheck Advisory on CapGo for additional technical context.

Detection Methods for CVE-2026-56225

Indicators of Compromise

Unexpected PUT, DELETE, or POST requests to Capgo API key management endpoints originating from app-scoped keys.
Newly created or modified API keys whose limited_to_apps value differs from the caller's scope.
Deletion or rotation of API keys that was not initiated by an administrator or CI/CD workflow.

Detection Strategies

Audit Capgo API access logs for cross-application key management calls, correlating the caller's limited_to_apps value with the target key's app association.
Alert when a single API key performs management operations against multiple distinct application IDs within a short window.
Review historical API key inventory for keys created or modified by callers that should not have account-level authority.

Monitoring Recommendations

Forward Capgo API audit events to a centralized log platform and retain them for incident investigation.
Establish a baseline of expected API key management activity per service account and alert on deviations.
Continuously inventory active API keys and flag unexplained changes to scope, owner, or secret material.

How to Mitigate CVE-2026-56225

Immediate Actions Required

Upgrade Capgo to version 12.128.2 or later as soon as possible.
Rotate all API keys that may have been exposed to app-scoped callers, prioritizing account-level credentials.
Review API key audit history for unauthorized create, update, or delete operations since app-scoped keys were issued.
Restrict network access to Capgo API key management endpoints to trusted administrative sources where feasible.

Patch Information

The vulnerability is fixed in Capgo 12.128.2. The fix adds the missing limited_to_apps enforcement to the public API key management handlers (get, put, delete, post). Refer to the GitHub Security Advisory GHSA-hwc7-j2p6-43xp for upstream patch details.

Workarounds

Avoid issuing API keys with mode=all combined with limited_to_apps until the patch is applied.
Replace broad keys with narrowly scoped credentials per application and revoke unused keys.
Place an upstream gateway or reverse proxy in front of the Capgo API to enforce per-app authorization on management routes.

bash

# Configuration example
# Upgrade Capgo to the patched release
npm install @capgo/capgo@^12.128.2

# Verify installed version
npm ls @capgo/capgo