CVE-2026-56225

High

Description

Capgo before 12.128.2 contains an authorization bypass vulnerability in its public API key management handlers (get/put/delete/post). API keys created with mode=all but restricted to a single app via limited_to_apps are only checked for limited_to_orgs and not for limited_to_apps, so an app-scoped key can enumerate, update, and delete sibling API keys belonging to the same account that are outside its declared app scope, enabling tampering with account-level credentials.

SeverityHigh

CVSS8.3

Exploit probability—

ProductCapgo

PublishedJun 23, 2026

First seenJun 23, 2026

Weakness typeCWE-269Improper privilege management

How to fix

Update

Capgo Capgo12.128.2 or later

Vendor advisories

github.com/Cap-go/capgo/security/advisories/GHSA-hwc7-j2p6-43xp

Affected products

Product	Affected versions	Fixed in
Capgo Capgo	v < 12.128.2	12.128.2

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.