CVE-2026-56310 Overview
CVE-2026-56310 is an authorization bypass vulnerability in Cap-go (capgo) versions before 12.128.2. The flaw exists in the GET /organization/members endpoint, which fails to enforce limited_to_orgs restrictions on org-scoped API keys. Attackers holding an org-limited API key can read membership records from organizations outside their assigned scope. Exposed data fields include uid, email, image_url, role, and is_tmp. The issue is tracked under CWE-285: Improper Authorization.
Critical Impact
Authenticated attackers with low-privilege org-scoped API keys can enumerate members and harvest email addresses across tenant boundaries, enabling targeted phishing and lateral reconnaissance.
Affected Products
- Cap-go (capgo) versions prior to 12.128.2
- Self-hosted Capgo deployments exposing the /organization/members REST endpoint
- Multi-tenant Capgo instances issuing API keys with limited_to_orgs scope
Discovery Timeline
- 2026-06-24 - CVE-2026-56310 published to NVD
- 2026-06-25 - Last updated in NVD database
Technical Details for CVE-2026-56310
Vulnerability Analysis
Capgo issues API keys that can be scoped to a subset of organizations through a limited_to_orgs attribute. This attribute should restrict every authenticated request to organizations explicitly listed in the key's scope. The GET /organization/members handler does not apply this filter when retrieving membership records. As a result, a caller authenticated with a valid but org-limited key can request members of any organization known to the system.
The returned payload includes user identifiers, email addresses, profile image URLs, assigned roles, and the is_tmp flag. This combination is sufficient to map tenant administrators, build targeted phishing lists, and identify temporary accounts that may have weaker controls. The vulnerability does not permit modification of records, so impact is limited to confidentiality of membership metadata.
Root Cause
The root cause is a missing authorization check inside the members listing endpoint. The handler validates that the request carries a valid API key but does not cross-reference the requested organization_id against the key's limited_to_orgs allowlist. The fix in version 12.128.2 enforces the scope comparison before the database query executes. See the GitHub Security Advisory GHSA-q7xv-p34q-v365 for vendor remediation details.
Attack Vector
Exploitation requires a network-reachable Capgo API and a valid org-limited API key. The attacker sends an authenticated GET request to /organization/members with an organization_id parameter referencing a target organization outside the key's scope. The server returns the membership list without rejecting the request. No user interaction is required, and the attack complexity is low. Additional context is available in the VulnCheck advisory.
Detection Methods for CVE-2026-56310
Indicators of Compromise
- Successful GET /organization/members responses where the requesting API key's limited_to_orgs list does not include the queried organization_id.
- API keys generating membership reads against an unusually broad range of organization identifiers within a short timeframe.
- Outbound enumeration patterns where a single key iterates sequential or scripted organization_id values.
Detection Strategies
- Correlate API gateway logs with the API key scope database and alert when the requested organization is outside the key's allowed set.
- Baseline normal request volume per API key and flag deviations targeting the members endpoint.
- Hunt for HTTP 200 responses on /organization/members paired with API keys flagged as org-limited in the identity store.
Monitoring Recommendations
- Enable verbose access logging on the Capgo API tier with full request URI, key identifier, and response status fields.
- Forward authentication and authorization decisions to a central log platform for retrospective analysis.
- Track per-key access to distinct organization_id values and alert when cardinality exceeds the scope size.
How to Mitigate CVE-2026-56310
Immediate Actions Required
- Upgrade Capgo to version 12.128.2 or later across all production and staging environments.
- Rotate API keys that may have been used to query the /organization/members endpoint during the exposure window.
- Review access logs for cross-organization queries and notify affected tenants if member data was exfiltrated.
Patch Information
The vendor released a fix in Capgo 12.128.2 that enforces the limited_to_orgs scope check inside the members endpoint. Upgrade instructions and the patch commit are referenced in the GitHub Security Advisory GHSA-q7xv-p34q-v365. Operators running self-hosted deployments should pull the updated release artifacts and redeploy.
Workarounds
- Temporarily revoke org-limited API keys until the patched version is deployed.
- Restrict the /organization/members endpoint at the reverse proxy or API gateway to administrative source addresses.
- Apply a gateway-level policy that validates the requested organization_id against the API key's scope before forwarding the request.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
