CVE-2026-56232
Capgo - Subkey Scope Bypass in middlewareKey via x-limited-key-id Header
- State
- Published
- Severity
- 8.7 High
- Published
- Jun 24, 2026
- Updated
- Jun 24, 2026
- Reserved
- Jun 19, 2026
Description
Capgo before 12.128.2 fails to enforce limited_to_orgs and limited_to_apps constraints on subkeys provided via x-limited-key-id header in middlewareKey function. Attackers can bypass subkey scope restrictions by referencing their own subkeys, causing all downstream route handlers to use the unrestricted parent key instead of the scoped subkey.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.8 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-863 Incorrect Authorization
Affected Products
| Product | Versions |
|---|---|
CapgoCapgo |
|
References
- GitHub Security Advisory (GHSA-2h89-vcvx-5pvh)vendor-advisory
- VulnCheck Advisory: Capgo - Subkey Scope Bypass in middlewareKey via x-limited-key-id Headerthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.