CVE-2026-56230: Capgo - Broken Object Level Authorization via x-limited-key-id Header
Capgo before 12.128.2 contains a broken object level authorization vulnerability in middlewareKey() that accepts the client-controlled x-limited-key-id header without validating ownership, allowing authenticated users to adopt cross-tenant limited keys. Attackers can supply another tenant's limited key ID to bypass authorization checks and access unauthorized cross-tenant resources across multiple API endpoints.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56230?
The severity of CVE-2026-56230 is rated high with a score of 8.7.
How do I fix CVE-2026-56230?
To fix CVE-2026-56230, update Capgo to version 12.128.2 or later, which addresses the broken object level authorization vulnerability.
What does CVE-2026-56230 affect?
CVE-2026-56230 affects Capgo versions prior to 12.128.2, specifically targeting its middlewareKey() function.
What is the impact of CVE-2026-56230?
The impact of CVE-2026-56230 allows authenticated users to adopt cross-tenant limited keys due to lack of validation of the x-limited-key-id header.
Who is at risk due to CVE-2026-56230?
Authenticated users of Capgo prior to version 12.128.2 are at risk due to potential exploitation of the authorization vulnerability.