CyberRota Analysis
AI-GeneratedA scope isolation vulnerability in Capgo prior to version 12.128.2 allows attackers with app-scoped API keys to execute org-scoped webhook operations via the POST /webhooks/test endpoint. This flaw enables unauthorized triggering of signed outbound webhook deliveries for any organization, circumventing the intended authorization checks. Organizations using affected versions should prioritize patching to mitigate potential exploitation risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Capgo before 12.128.2 contains a scope isolation vulnerability in the POST /webhooks/test endpoint that allows app-scoped API keys to invoke org-scoped webhook operations. Attackers with app-scoped credentials can trigger signed outbound webhook deliveries for arbitrary organization webhooks outside their declared app boundary, bypassing the limited_to_apps authorization check.