CVE-2026-56246: Capgo - Cross-Organization Authorization Bypass via Scoped API Key Privilege Inheritance
Capgo before 12.128.2 contains a broken access control vulnerability in the organization management API where a scoped API key (limitedtoorgs) inherits its owner-user's permissions, allowing destructive cross-organization actions. When a user is an admin in two organizations and creates a write-mode API key restricted to one organization, that key can still perform destructive operations (e.g., DELETE /organization, DELETE /organization/members) against another organization. The root cause is route-level authorization (rbaccheckpermissiondirect) that evaluates the key owner's user privileges before enforcing the API key's limitedtoorgs scope.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Capgoto a version that resolves this vulnerability.Fixed in 12.128.2 - Compensating control
Until upgraded, prevent scoped API keys (limited_to_orgs) from being used with endpoints capable of destructive cross-organization actions such as DELETE /organization and DELETE /organization/members.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56246?
CVE-2026-56246 has a high severity rating of 8.1.
How do I fix CVE-2026-56246?
To mitigate CVE-2026-56246, upgrade Capgo to version 12.128.2 or later.
What type of vulnerability is CVE-2026-56246?
CVE-2026-56246 is a broken access control vulnerability.
What can an attacker do with CVE-2026-56246?
An attacker exploiting CVE-2026-56246 can perform destructive cross-organization actions due to privilege inheritance.
Which software is affected by CVE-2026-56246?
CVE-2026-56246 affects Capgo versions prior to 12.128.2.