CyberRota Analysis
AI-GeneratedCapgo versions prior to 12.128.2 are vulnerable due to a broken access control flaw in the organization management API, where scoped API keys can inherit permissions from their owner-user. This allows users with admin rights in multiple organizations to perform destructive actions, such as deleting organizations or members, across organizations they should not have access to. Organizations using Capgo should prioritize patching this vulnerability to mitigate the risk of unauthorized data manipulation and potential data breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Capgo before 12.128.2 contains a broken access control vulnerability in the organization management API where a scoped API key (limited_to_orgs) inherits its owner-user's permissions, allowing destructive cross-organization actions. When a user is an admin in two organizations and creates a write-mode API key restricted to one organization, that key can still perform destructive operations (e.g., DELETE /organization, DELETE /organization/members) against another organization. The root cause is route-level authorization (rbac_check_permission_direct) that evaluates the key owner's user privileges before enforcing the API key's limited_to_orgs scope.