CVE-2026-56246 Overview
CVE-2026-56246 is a broken access control vulnerability in Capgo before version 12.128.2. The flaw resides in the organization management API where scoped API keys inherit their owner's user-level permissions. An API key marked as limited_to_orgs and restricted to a single organization can still perform destructive operations against other organizations where the key owner holds admin privileges. The root cause is route-level authorization via rbac_check_permission_direct, which evaluates the owner's user privileges before enforcing the API key scope. This weakness maps to CWE-285: Improper Authorization.
Critical Impact
A scoped write-mode API key can execute DELETE /organization and DELETE /organization/members against organizations outside its declared scope, enabling cross-tenant destruction of data and membership.
Affected Products
- Capgo versions prior to 12.128.2
- Capgo organization management API endpoints
- Deployments using scoped (limited_to_orgs) API keys
Discovery Timeline
- 2026-07-08 - CVE-2026-56246 published to the National Vulnerability Database
- 2026-07-08 - Last updated in NVD database
Technical Details for CVE-2026-56246
Vulnerability Analysis
Capgo issues API keys that can be marked limited_to_orgs to restrict operations to a specific organization identifier. The API expects this scope to constrain the key's blast radius. In practice, the authorization layer never enforces the scope for organization management routes. The route-level check rbac_check_permission_direct resolves the requester's underlying user account and evaluates that user's role assignments across all organizations they belong to. If the key owner is an admin in organizations A and B, a key scoped only to A still authorizes admin-level actions on B. The result is a horizontal privilege escalation across tenant boundaries.
Root Cause
The authorization function orders its checks incorrectly. The scoped API key metadata (limited_to_orgs) is not consulted before the RBAC user lookup returns success. Because the user record grants admin rights on multiple organizations, the request passes authorization regardless of the target organization in the request path. The key scope becomes advisory rather than enforced.
Attack Vector
An authenticated admin who operates in two or more organizations generates a write-mode API key restricted to a low-trust organization. The key can then be used to issue destructive HTTP requests such as DELETE /organization or DELETE /organization/members against a different organization identifier. This turns a limited-scope credential into a full admin token across every organization the owner belongs to. The attack requires network access and low privileges but no user interaction.
No public proof-of-concept exploit is available. Technical details are documented in the GitHub Security Advisory GHSA-ccm4-hf72-p28m and the Vulncheck advisory on Capgo cross-organization authorization bypass.
Detection Methods for CVE-2026-56246
Indicators of Compromise
- API requests to DELETE /organization or DELETE /organization/members where the target organization_id does not match the API key's limited_to_orgs value.
- Successful destructive operations executed by API keys rather than interactive user sessions.
- Unexpected drops in organization membership counts or missing organizations without corresponding UI activity.
Detection Strategies
- Correlate API access logs against the limited_to_orgs metadata stored with each key and alert on any mismatch between key scope and target organization.
- Baseline normal API key usage per organization and flag keys that operate across multiple organization_id values.
- Review audit logs for high-impact endpoints such as organization deletion and membership removal, filtering on API key authentication.
Monitoring Recommendations
- Enable verbose audit logging on all Capgo organization management routes and forward events to a centralized SIEM.
- Track the ratio of destructive to read operations per API key and alert on outliers.
- Monitor for API keys that authenticate but reference organization identifiers absent from their scope metadata.
How to Mitigate CVE-2026-56246
Immediate Actions Required
- Upgrade Capgo to version 12.128.2 or later where the authorization ordering is corrected.
- Rotate all existing scoped API keys after upgrading, since previously issued keys may have been used cross-organization.
- Audit organization membership and deletion logs for the period preceding the patch to identify unauthorized destructive activity.
Patch Information
The fix is included in Capgo 12.128.2. Refer to the GitHub Security Advisory GHSA-ccm4-hf72-p28m for patch commit references and upgrade guidance.
Workarounds
- Restrict admin membership so that individual users are admins in only one organization until the upgrade is applied.
- Revoke any write-mode API keys owned by users with admin roles across multiple organizations.
- Enforce reverse-proxy or WAF rules that reject requests whose path organization_id does not match the API key's declared scope.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
