CVE-2026-100628: capgo.app before 12.128.12 Authentication Bypass via apikey
capgo.app before 12.128.12 fails to enforce an organization's API key expiration policy when creating app-scoped API keys. In the POST /apikey endpoint, requests that supply appid but omit orgid, limitedtoorgs, and expiresat resolve the target app and scope the key to it, but never add the app's owner organization to the list of organization IDs passed to validateExpirationAgainstOrgPolicies; because that list is empty, the validation returns early. As a result, an authenticated organization member can create a non-expiring app-scoped API key even when the owning organization has requireapikeyexpiration enabled and a maxapikeyexpirationdays limit configured. The issue is fixed in version 12.128.12.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
capgo.appto a version that resolves this vulnerability.Fixed in 12.128.12
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated member of an organization can exploit it. The affected organization must have API-key expiration enforcement enabled and a maximum API-key lifetime configured.
What request conditions trigger the bypass?
The POST /apikey request must provide app_id while omitting org_id, limited_to_orgs, and expires_at. The resulting key is scoped to the specified app but can be created without an expiration.
Are default configurations affected?
The described policy bypass matters only where the owning organization has require_apikey_expiration enabled and max_apikey_expiration_days configured. The provided data does not establish that these settings are enabled by default.
How can administrators determine whether they may be affected?
Check whether capgo.app is earlier than 12.128.12 and whether organizations enforce API-key expiration with a maximum lifetime. Review app-scoped API keys for non-expiring keys created by organization members, particularly where the creation request could have omitted org_id, limited_to_orgs, and expires_at.
What should be done if immediate upgrading is not possible?
Review and revoke or replace non-expiring app-scoped API keys that violate the organization’s expiration policy. Limit API-key creation to trusted organization members until the instance can be updated to 12.128.12.